Proxmox 7 + Hetzner + vswitch => connectivity issues while using 2 bridges

[mike86]

I have fairly big issues with internet/network connectivity in VMs (Windows/Linux).

For windows:
- many websites doesn't work
- connects fine to MySQL server running in Proxmox container

App1 (.net) running on Hetzner vswitch let say machine004
- won't connect to MySql server running in Proxmox (192.168.0.200 (via vswitch & vmbr2)

MySql running on vswitch and machine007
- windows machine in debug will connect fine
- windows machine with HeidiSQL connects fine
- can ping and login into mysql from machine004 bash
- cannot connect from App1 running in docker on machine004 (getting aborted connection on mysql & (Got an error writing communication packets)

my.cnf is the same as on bare metal MySql instances and for 100% is fine (machines running with 128GB of RAM/i9 9900k/nvme)


Can someone check my config to check for any errors ? vmbr2 is basically a connection to Hetzner vswitch that is required to communicate internally between servers (MySQL machines are not available online, they are accessed via apps from other servers).

I will add that the same setup on ESXi works fine.

auto lo
iface lo inet loopback

iface lo inet6 loopback

auto eno1
iface eno1 inet manual
        up route add -net XXXXXXX

netmask 255.255.255.224
gw XXXXXXX dev eno1
# route XXXXXX/27 via XXXXXXXX

auto eno1.4000
iface eno1.4000 inet manual
        mtu 1400

iface eth0 inet manual

auto vmbr0
iface vmbr0 inet static
        address XXXXXXX/27
        gateway XXXXXXX
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0

auto vmbr1
iface vmbr1 inet static
        address 10.254.254.254/8
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/8' -o vmbr0 -j MASQUERADE
        post-up iptables -A POSTROUTING -t nat -s 10.0.0.0/8 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/8' -o vmbr0 -j MASQUERADE


auto vmbr2
iface vmbr2 inet static
        address 192.168.0.100/8
        bridge-ports eno1.4000
        bridge-stp off
        bridge-fd 0

 

[B.Otto]

Hello,

I do wonder what that second iptables-rule is for:

post-up iptables -A POSTROUTING -t nat -s 10.0.0.0/8 -j MASQUERADE

For the usual 'NAT traffic from private network 10.0.0.0/8 going through the WAN interface' the three rules should be enough:

        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/8' -o vmbr0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/8' -o vmbr0 -j MASQUERADE