Proxmox Firewall for NAT

Discussion in 'Proxmox VE: Networking and Firewall' started by vikozo, Nov 20, 2014.

  1. vikozo

    vikozo Member

    Joined:
    May 4, 2014
    Messages:
    257
    Likes Received:
    2
    Hello
    it is possible to use the Proxmox Firewall as NAT?

    I would imagine to use the (1) WAN IP Port and translate it to (x) Private IP Address on different Container and KVM.
    If my provider would change my Router IP - I would have a down time - but this is no Problem. I think as soon I have changed Internic Nameserver IP to the new Router IP and changed the Firewall Rule it should be working again, after a delay.

    I hope my thoughts would work.

    have a nice day
    vinc
     
  2. dietmar

    dietmar Proxmox Staff Member
    Staff Member

    Joined:
    Apr 28, 2005
    Messages:
    16,484
    Likes Received:
    314
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. vikozo

    vikozo Member

    Joined:
    May 4, 2014
    Messages:
    257
    Likes Received:
    2
    Hello Dietmar
    Thanks for your help.
    i have been reading... but maybe i need help to understand it!
    have a nice day
    vinc
     
  4. vikozo

    vikozo Member

    Joined:
    May 4, 2014
    Messages:
    257
    Likes Received:
    2
    i have been reading it and a bit confused
    should i give the container which have to be connected a ip address from another IP Range

    i have this network setup till now
    bond0.PNG


    have a nice day
    vinc
     
  5. vikozo

    vikozo Member

    Joined:
    May 4, 2014
    Messages:
    257
    Likes Received:
    2
    would it be better to have a vmbr2 identical to the vmbr1 above

    with this code
    # information:
    # Range for Virtuell Server would be
    # 10.147.42.194 to
    # 10.147.42.254
    # GW would be 10.147.42.193

    would this be working?
    But how the traffic would go - because the Router still have 10.147.42.1/24

    have a nice day
    vincent
     
  6. kotakomputer

    kotakomputer Member

    Joined:
    May 14, 2012
    Messages:
    356
    Likes Received:
    5
    Just set the GATEWAY to 10.147.42.1
     
  7. vikozo

    vikozo Member

    Joined:
    May 4, 2014
    Messages:
    257
    Likes Received:
    2
    i would belive this is not working because of the wrong Subnetmask - but not to sure, would be nice to find a confirmation befor i do the change!

    Another Question
    would it be possible to change the eth0 to bond1 so i would have the traffic over both ports
    have a nice day
    vinc
     
  8. vikozo

    vikozo Member

    Joined:
    May 4, 2014
    Messages:
    257
    Likes Received:
    2
    any help or idea or confimation :confused:
     
  9. vikozo

    vikozo Member

    Joined:
    May 4, 2014
    Messages:
    257
    Likes Received:
    2
  10. vikozo

    vikozo Member

    Joined:
    May 4, 2014
    Messages:
    257
    Likes Received:
    2
    :cool: it seems - i am the only on how wish to use NAT :confused:
     
  11. Roadwaymoving9

    Roadwaymoving9 New Member

    Joined:
    Dec 9, 2014
    Messages:
    1
    Likes Received:
    0
    Hello Sir,

    Thanks for your help.

    Roadway Moving
     
  12. vikozo

    vikozo Member

    Joined:
    May 4, 2014
    Messages:
    257
    Likes Received:
    2
    Hello is there a way or tutorial to do the NAT with proxmox Firewall feature?
    have a nice day
    vinc
     
  13. jdinkel

    jdinkel New Member

    Joined:
    Dec 23, 2014
    Messages:
    1
    Likes Received:
    0
    I'm also wondering if there is anyway to do this through the web interface, possibly utilizing the new Firewall feature. I'm a little surprised I would have to log into the console and edit the text file for every virtual machine and on every machine in the cluster that they might migrate to. I'm new to Proxmox, but it seems like a pretty basic functionality and should be possible through the web interface.
     
  14. spirit

    spirit Well-Known Member

    Joined:
    Apr 2, 2010
    Messages:
    3,370
    Likes Received:
    140
    Hi, you need kernel 3.10 and add specials rules

    iptables -t raw -A PREROUTING -i fwbr100i0 -j CT --zone 1

    iptables -t raw -A POSTROUTING -i fwbr100i0 -j CT --zone 1

    (replace fwbr100i0 , with 100 is your vmid)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  15. flav

    flav New Member

    Joined:
    Mar 12, 2015
    Messages:
    11
    Likes Received:
    0
    Hello,

    This is not working for me. Can some one help ?

    I'm tring to setup a VM with NAT and ProxmoxVE Firewall.
    My config is:
    on the host with ProxMox 3.4-1:

    Upgraded to kernel 3.10:
    Code:
    # uname -a
    Linux XXXX 3.10.0-7-pve #1 SMP Thu Jan 22 11:20:00 CET 2015 x86_64 GNU/Linux
    /etc/network/interfaces
    Code:
    auto vmbr2
    iface vmbr2 inet static
       address 192.168.0.254
       netmask 255.255.255.0
       bridge_ports none
       bridge_stp off
       bridge_fd 0
       post-up echo 1 > /proc/sys/net/ipv4/ip_forward
       post-up iptables -t nat -A POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE
       post-down iptables -t nat -D POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE
    On the VM:
    /etc/network/interfaces
    Code:
    iface eth0 inet static
       address 192.168.0.1
       netmask 255.255.255.0
       network 192.168.0.0
       broadcast 192.168.0.255
       gateway 192.168.0.254
    Without PVE firewall activated it is ok.

    I have also tried on host the suggestion of spirit (replaced fwbr100i0 with tap100i0):
    Code:
    # iptables -t raw -A PREROUTING -i tap100i0 -j CT --zone 1
    # iptables -t raw -A POSTROUTING -i tap100i0 -j CT --zone 1
    On the second command I got the error:
    Code:
    iptables v1.4.14: Can't use -i with POSTROUTING
    Does someone can help please ?
    @spirit do you have any idea ?

    Regards,
    Flav
     
  16. spirit

    spirit Well-Known Member

    Joined:
    Apr 2, 2010
    Messages:
    3,370
    Likes Received:
    140

    maybe -o

    (postrouting is for output)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  17. flav

    flav New Member

    Joined:
    Mar 12, 2015
    Messages:
    11
    Likes Received:
    0
    Hi,
    Looks somehow better... but still not ok:
    Code:
    # iptables -t raw -A POSTROUTING   -o tap100i0 -j CT --zone 1
    iptables: No chain/target/match by that name.
     
  18. flav

    flav New Member

    Joined:
    Mar 12, 2015
    Messages:
    11
    Likes Received:
    0
    Hi,
    Issue solved.
    Do not need to add any rule in raw table.

    You just need to add a some firewall rules to allow your VM to access your virtual network.

    eg from 192.168.0.0/24 to some_internal_IP on ICMP
     
  19. jbbr

    jbbr New Member

    Joined:
    Oct 21, 2015
    Messages:
    1
    Likes Received:
    0

    Thanks, it's been a long while since your post but this did the trick for me.

    I only needed the first rule:

    iptables -t raw -A PREROUTING -i fwbr100i0 -j CT --zone 1
     
  20. mattiabar

    mattiabar New Member

    Joined:
    Sep 3, 2015
    Messages:
    3
    Likes Received:
    0
    Hi, I have your same situation, kvm internal virtual machine not reaching internet when firewall is activated. Could you please be more precise and explain me which rules you have applied?

    Thanks in advance
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice