[SOLVED] Proxmox NAT - hetzner

demon_mono

Member
Nov 24, 2020
24
1
23
38
Hello everybody ,

I made a px server on a hetzner server for test.
I can not reach a port defined as open on a VM ( here : VM 254 , ip 192.168.50.54 , port 21116 , protocol tcp )

Here is network configuration :
Bash:
auto enp0s31f6
iface enp0s31f6 inet static
        address 95.216.37.188/26
        gateway 95.216.37.129
        up route add -net 95.216.37.128 netmask 255.255.255.192 gw 95.216.37.129 dev enp0s31f6
# route 95.216.37.128/26 via 95.216.37.129
auto vmbr1
iface vmbr1 inet static
 address 192.168.50.1
 netmask 255.255.255.0
 bridge_ports none
 bridge_stp off
 bridge_fd 0
  post-up echo 1 > /proc/sys/net/ipv4/ip_forward
  post-up   iptables -t nat -A POSTROUTING -s '192.168.50.0/24' -o enp0s31f6 -j MASQUERADE
  post-down iptables -t nat -D POSTROUTING -s '192.168.50.0/24' -o enp0s31f6 -j MASQUERADE
  post-up iptables -t nat -A PREROUTING -i vmbr1 -p tcp --dport 21116 -j DNAT --to 192.168.50.54:21116
  post-down iptables -t nat -D PREROUTING -i vmbr1 -p tcp --dport 21116 -j DNAT --to 192.168.50.54:21116

Form the px host , I can reach it :
Bash:
root@px ~ # nmap -p 21116 192.168.50.54
Starting Nmap 7.80 ( https://nmap.org ) at 2022-07-07 13:23 CEST
Nmap scan report for 192.168.50.54
Host is up (0.000037s latency).

PORT      STATE SERVICE
21116/tcp open  unknown

But from outside, that doesn't work :

Bash:
root@server:~# nmap -p 21116 px.ethicit.fr
Starting Nmap 7.80 ( https://nmap.org ) at 2022-07-07 13:22 CEST
Nmap scan report for px.ethicit.fr (95.216.37.188)
Host is up (0.050s latency).
Other addresses for px.ethicit.fr (not scanned): 2a01:4f9:2a:25c3::
rDNS record for 95.216.37.188: hetzner

PORT      STATE  SERVICE
21116/tcp closed unknown

Any idea ?

Regards,
 
hi,

Code:
post-up iptables -t nat -A PREROUTING -i vmbr1 -p tcp --dport 21116 -j DNAT --to 192.168.50.54:21116
post-down iptables -t nat -D PREROUTING -i vmbr1 -p tcp --dport 21116 -j DNAT --to 192.168.50.54:21116
replace vmbr1 with enp0s31f6 in both lines and restart the interface with ifreload -a
 
Last edited: