Port forwarding through iptables

[armpogart]

I have following setup currently:

# /etc/network/interfaces
auto lo
iface lo inet loopback

iface eno1 inet manual

auto vmbr0
iface vmbr0 inet static
        address <MAIN Public IP>
        netmask 255.255.255.224
        gateway <MAIN Gateway>
        bridge_ports eno1
        bridge_stp off
        bridge_fd 0
        up ip route add <ANOTHER PUBLIC IP>/32 dev vmbr0

# NAT bridge
auto vmbr1
iface vmbr1 inet static
        address  10.10.10.1
        netmask  255.255.255.0
        bridge_ports none
        bridge_stp off
        bridge_fd 0

        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE
        post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 6022 -j DNAT --to 10.10.10.5:22
        post-down iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 6022 -j DNAT --to 10.10.10.5:22
        post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 6122 -j DNAT --to 10.10.10.6:22
        post-down iptables -t nat -D PREROUTING -i eth0 -p tcp --dport 6122 -j DNAT --to 10.10.10.6:22

Some guest VMs have only private ip (as 10.10.10.5 in example), so they have on virtual nic (vmbr1). One VM guest has both public ip and private ip, so it has 2 virtual nics (one from vmb0 and another for vmbr1). Port forwarding is working ok, until I restart networking service on Proxmox node. As soon as I restart networking I lose port-forwarding until restarting PVE node. Any way to fix this behavior?

P.S. I'm usually restarting networking when adding another port-forwarding rule to existing VM or new VM, but even without changing anything on file, and simply restarting networking breaks port forwarding.

 

[Rares]

So far I used 2 methods:
- put all the IP Tables rules in /etc/rc.local and every time reload the rc.local file.
- lately I use CSF firewall so I can block failed login attempts etc. too.

In the end I created small KVM machine that runs a minimal linux and acts as a gateway router + nginx proxy for virtual domains so that on the proxmox host I use no scripts/rules at all.

I would be interesting in the future if I could somehow connect the CSF with the Proxmox firewall API.

 

[armpogart]

Bumping, as I still don't understand why networking doesn't work after restarting it. The problem seems to be in PVE, as usually restarting networking must work properly.

Any help is appreciated.