Proxmox-VM: No connection via public IP

[Rootinator]

Hello,

I use NAT (iptables) for my virtual machines to connect to the Internet.

From outside they are accessible via the public IP : port.

The following problem:

I want VM1 to connect to VM2.
They should connect via the public IP of the host (IP : port).

Now VM1 cannot connect to VM2 via the public IP : port.

Not possible:

VM1 → public IP : port of host → VM2

How can I fix the problem?

Here are my /etc/network/interfaces:

auto lo
iface lo inet loopback

auto eno1
iface eno1 inet manual

auto vmbr0
iface vmbr0 inet static
        address  192.168.0.100
        netmask  255.255.255.0
        gateway  192.168.0.1
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0

# VM-Connect

auto vmbr1
iface vmbr1 inet static
        address  10.0.0.1
        netmask  24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/24' -o vmbr0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/24' -o vmbr0 -j MASQUERADE
       
       
# Port forwarding
       
# VM1
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 80 -j DNAT --to 10.0.0.15:80
post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 80 -j DNAT --to 10.0.0.15:80

# VM2
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 8080 -j DNAT --to 10.0.0.10:80
post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 8080 -j DNAT --to 10.0.0.10:80

In the beginning I had used VMware-Workstation (Windows) on the host, here my project had worked perfectly, only with Proxmox it didn't work.

 

[Stefan_R]

(I'm assuming here that 10.0.0.0/24 is the "public" network you're talking about)

The problem you are running into is called "hairping routing" or "NAT reflection". Basically, your existing MASQUERADE rules don't play nice with what you're trying to do. You can either do NAT reflection on your router (and have the packets travel on the wire to and from the physical router) or set up some clever iptables rules (e.g. here is some inspiration, but you'd have to modify those rules for your use-case).