Private subnet: host can connect to guests, guests to internet, but not to host or each other

[panyasan]

Hello,

I have done my research, but didn't find a solution. I have the following problem: I have a simple private subnet on the host:

iface vmbr1 inet static
  address 10.10.10.1
  netmask 255.255.255.0
  bridge_ports none
  bridge_stp off
  bridge_fd 0

  # Enable NAT so machines in this network can reach the internet
  post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE
  post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE

and I can reach the LXC guests on this subnet without any problems (ssh from host, reverse proxy from VM in different subnet and with public IP etc.). The guests have no trouble reaching the internet.

However, the guests cannot reach the host (ping, ssh) nor each other.

I have not changed the guests' default /etc/network/interfaces config, since it routes all traffic correctly over vmbr1. What do i miss?

Thanks for pointers...

 

[dale]

It seems ещ ьу

post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' ! -d '10.10.10.0/24' -o eth0 -j MASQUERADE

should help you.

 

[panyasan]

Thank you very much. The LXC containers can now talk to each other!

However, I still cannot connect to the proxmox host from the containers. Should this work out of the box and I misconfigured something? Do I need an additional bridge to make this work? Or must this be solved by manual routing?

This is probably trivial, I just don't seem to find the right answer. Thanks a bunch for helping out...

 

[panyasan]

In case you wonder why I don't try out different rules until success: I have a couple of containers with applications in production and I cannot repeatedly restart the host in order to make the new rules effective. I just need a small cue how to solve my problem, the rest I can figure out myself. Thank you for any advice on the matter.

 

[dale]

Thank you very much. The LXC containers can now talk to each other!

However, I still cannot connect to the proxmox host from the containers. Should this work out of the box and I misconfigured something? Do I need an additional bridge to make this work? Or must this be solved by manual routing?

This is probably trivial, I just don't seem to find the right answer. Thanks a bunch for helping out...

To access proxmox from containers use 10.10.10.1 address as destination.

 

[panyasan]

Thanks, that's what I thought would be the case, but 10.10.10.1 does not respond. On a different board, someone told me I have to use a dummy interface ("bridge_ports dummy0") so that packets won't be discarded by the host. I still have to test that and will report.

UPDATE: It doesn't work, unfortunately.