NATing external IPs(not the host's) and SSH to them?

[YBEY]

Hey guys.
Om using online.net as my VPS, and i have several external IP addresses.

First, please explain to me how to NAT an up address other them my host's original?
Lets assume my hosts ip is 55.55.55.55 and i choose NAT in the network, no matter what i put in the "Mac address" field, i always get a NAT of the host IP
I want to choose one of the other IPs, lets say 11.22.33.44 and NAT that to several machines, any ideas?
(i assume the answer will be different for every OS, i mainly use Debian and Windows)

Second, Lets assume i did the above, and i have 2(or more) machines which share the same external IP (other than the hosts's)
issue is, im not sure how to access these machines with SSH, because they are behind a NAT
lets say the external IP is 11.22.33.44, What firewall rules do i have to set in the proxmox firewall (and into which machine) in order to make sure i can SSH to those different machines?

Thank you very much!

 

[Richard]

First, please explain to me how to NAT an up address other them my host's original?
Lets assume my hosts ip is 55.55.55.55 and i choose NAT in the network, no matter what i put in the "Mac address" field, i always get a NAT of the host IP
I want to choose one of the other IPs, lets say 11.22.33.44 and NAT that to several machines, any ideas?
(i assume the answer will be different for every OS, i mainly use Debian and Windows)

Not quite clear what you mean. you can have

(a) 1 public IP (assigned to the host) and a local network to other machines (VMs on the host) and acces via NAT from this network to the public one

OR

(b) more public IPs, one for each machine (VM)

In case of (a) the host should have a NAT service; there is built-in one in KVM but it´s very simple and not recommended. Do it with the following command (assuming your local network is 192.168.10.0/24):

iptables -t nat -A POSTROUTING ! -d 192.168.10.0/24 -j MASQUERADE

In case of (b) bridge the VMs´ NICs and assign the addresses to them (no NAT at all)

Second, Lets assume i did the above, and i have 2(or more) machines which share the same external IP (other than the hosts's)
issue is, im not sure how to access these machines with SSH, because they are behind a NAT
lets say the external IP is 11.22.33.44, What firewall rules do i have to set in the proxmox firewall (and into which machine) in order to make sure i can SSH to those different machines?

For machines which don´t have an own address you have to use solution (a) as described above.

In order to reach any of these machines via ssh from public you have to

- define a port number (which the client to specify instead of the usual 22)

- forward this port to the local network and proper address, (e.g. port 10022 for machine at 192.168.10.10):

iptables -t nat -A PREROUTING -p tcp --dport 10022 -j DNAT --to-destination 192.168.10.10:22

Depending on your configuration the iptables commands can be slightly different from the above mentioned ones.

Firewall settings are independent from this.