OpenVZ - VM Natted through another VM with internet access

[pichinep]

Hi everyone, i've tired of searching and searching and no answer founds... My goal is the next:

HOST: Proxmox server, with internet access directly. (PUB_IP1)

VM1: CT inside HOST with bridged IP (venet), and direct internet connection and another IP (venet) with local address (PUB_IP2, LOC_IP1)

VM1.2: CT inside HOST with local address (venet) (LOC_IP2)

So my answer is... How can i make, that VM1.2, access internet through VM1...

Thanks, i hope to be clear...

 

[Stewge]

The complication here is CTs and iptables. Also Bridged != venet. VENET is layer3, VETH is bridged. In this case you'll probably need to use VETH for your CTs.
There's 3 ways I can think of doing it:
1)
On VM1.2: First off use VETH (bridged) instead. Then connect it to the same bridge as VM1 (LOC_IP). Then just configure VM1.2 to use VM1(LOC_IP1) as it's default Gateway.
On VM1: Configure NAT in the guest CT to function for VM1.2. You need to add the iptables modules in the vz conf file in order to do this.
2)
Given that iptables in CTs isn't feature complete, you could setup a small KVM virtual running a routing distro (pfsense/ipcop/vyatta/whatever). Set it up as a router and bridge both VMs with it configured as default gateway.
3)
Use the Host system firewall. Configure so that it has both PUB_IP1 and PUB_IP2 (use ip aliasing). Then setup the host iptables to NAT to LOC_IP1 and LOC_IP2 (which can be venet or veth).

 

[pichinep]

Thank you very much!!! i've used the first option you said me... and it works...

Thank you again!!

The complication here is CTs and iptables. Also Bridged != venet. VENET is layer3, VETH is bridged. In this case you'll probably need to use VETH for your CTs.
There's 3 ways I can think of doing it:
1)
On VM1.2: First off use VETH (bridged) instead. Then connect it to the same bridge as VM1 (LOC_IP). Then just configure VM1.2 to use VM1(LOC_IP1) as it's default Gateway.
On VM1: Configure NAT in the guest CT to function for VM1.2. You need to add the iptables modules in the vz conf file in order to do this.
2)
Given that iptables in CTs isn't feature complete, you could setup a small KVM virtual running a routing distro (pfsense/ipcop/vyatta/whatever). Set it up as a router and bridge both VMs with it configured as default gateway.
3)
Use the Host system firewall. Configure so that it has both PUB_IP1 and PUB_IP2 (use ip aliasing). Then setup the host iptables to NAT to LOC_IP1 and LOC_IP2 (which can be venet or veth).