Code:
auto lo
iface lo inet loopback
iface enp2s0f0 inet manual
iface enp2s0f1 inet manual
auto vmbr0
iface vmbr0 inet static
address public_ip
netmask 255.255.255.0
gateway 100.64.1.9
bridge-ports enp2s0f0
bridge-stp off
bridge-fd 0
auto vmbr1
iface vmbr1 inet static
address 10.10.10.254
netmask 255.255.255.0
bridge-ports none
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE
only configure lan ip, can ping each other
after add public ip, 10.10.10.6 can't ping 10.10.10.4, but .4 can ping .6