private network breaks primary network

[ohmantics]

I have a Proxmox box running Docker via LXC and TrueNAS Core as a VM. (Yes, I'm an idiot and I shouldn't do it this way.)
I want to add a private network virtual bridge between the container and VM (to handle iSCSI storage traffic in an isolated way). Thus far, everything I've done doesn't work as expected.
I can ping between the dockerhost and the TrueNAS VM on the private network, but I can't also ping the outside (e.g. google.com). If I remove vmbr1, I can ping the outside just fine. I can get traffic into Proxmox and dockerhost (e.g. the HTTP GUIs work). iptables -L is the empty default on Proxmox and only has the extra default Docker rules in the dockerhost.

If this were FreeBSD or macOS, I'd already have it working, but there's something I don't know about Linux networking that's preventing it from working properly and searching online is failing me.

 

[aaron]

First, you only need an IP address on the vmbr interface itself from the Proxmox VE side, if it should be reachable on that network. If it is only used to connect the guests, you can also just not set an IP address on the vmbr interface

How is the network between the VM and container configured? Especially the routes?

If I remove vmbr1, I can ping the outside just fine.

This sounds a lot like the routes in the guest's might be a bit wrong. Did you set a gateway for the internal network or anything?

 

[ohmantics]

First, you only need an IP address on the vmbr interface itself from the Proxmox VE side, if it should be reachable on that network. If it is only used to connect the guests, you can also just not set an IP address on the vmbr interface

It's for iSCSI, so I believe that the host will need to handle the connection in order to offer the mounted volumes to the guests.

How is the network between the VM and container configured? Especially the routes?

I have added no routes. I don't think I need to here.

This sounds a lot like the routes in the guest's might be a bit wrong. Did you set a gateway for the internal network or anything?

The config is as you see in /etc/network/interfaces in the diagram.

 

[aaron]

It's for iSCSI, so I believe that the host will need to handle the connection in order to offer the mounted volumes to the guests.

If the host is the iSCSI target providing the LUNs then yes, it needs an IP in that network

The config is as you see in /etc/network/interfaces in the diagram.

Of the host AFAICT. What about the two guests? Network config and currently configured routes would be interesting.