[SOLVED] Proxmox NAT - hetzner

[demon_mono]

Hello everybody ,

I made a px server on a hetzner server for test.
I can not reach a port defined as open on a VM ( here : VM 254 , ip 192.168.50.54 , port 21116 , protocol tcp )

Here is network configuration :

auto enp0s31f6
iface enp0s31f6 inet static
        address 95.216.37.188/26
        gateway 95.216.37.129
        up route add -net 95.216.37.128 netmask 255.255.255.192 gw 95.216.37.129 dev enp0s31f6
# route 95.216.37.128/26 via 95.216.37.129
auto vmbr1
iface vmbr1 inet static
 address 192.168.50.1
 netmask 255.255.255.0
 bridge_ports none
 bridge_stp off
 bridge_fd 0
  post-up echo 1 > /proc/sys/net/ipv4/ip_forward
  post-up   iptables -t nat -A POSTROUTING -s '192.168.50.0/24' -o enp0s31f6 -j MASQUERADE
  post-down iptables -t nat -D POSTROUTING -s '192.168.50.0/24' -o enp0s31f6 -j MASQUERADE
  post-up iptables -t nat -A PREROUTING -i vmbr1 -p tcp --dport 21116 -j DNAT --to 192.168.50.54:21116
  post-down iptables -t nat -D PREROUTING -i vmbr1 -p tcp --dport 21116 -j DNAT --to 192.168.50.54:21116

Form the px host , I can reach it :

root@px ~ # nmap -p 21116 192.168.50.54
Starting Nmap 7.80 ( https://nmap.org ) at 2022-07-07 13:23 CEST
Nmap scan report for 192.168.50.54
Host is up (0.000037s latency).

PORT      STATE SERVICE
21116/tcp open  unknown

But from outside, that doesn't work :

root@server:~# nmap -p 21116 px.ethicit.fr
Starting Nmap 7.80 ( https://nmap.org ) at 2022-07-07 13:22 CEST
Nmap scan report for px.ethicit.fr (95.216.37.188)
Host is up (0.050s latency).
Other addresses for px.ethicit.fr (not scanned): 2a01:4f9:2a:25c3::
rDNS record for 95.216.37.188: hetzner

PORT      STATE  SERVICE
21116/tcp closed unknown

Any idea ?

Regards,

 

[oguz]

hi,

post-up iptables -t nat -A PREROUTING -i vmbr1 -p tcp --dport 21116 -j DNAT --to 192.168.50.54:21116
post-down iptables -t nat -D PREROUTING -i vmbr1 -p tcp --dport 21116 -j DNAT --to 192.168.50.54:21116

replace vmbr1 with enp0s31f6 in both lines and restart the interface with ifreload -a

 

[demon_mono]

Wow that works thanks

But why ? Can you simply explain ?

 

[oguz]

But why ? Can you simply explain ?

the input interface should be the physical NIC instead of the bridge (since your connection is inbound to the PVE server)

Wow that works thanks

glad to be of help, you can mark the thread as [SOLVED]

 

[demon_mono]

you can mark the thread as [SOLVED]

done !