Hi,
thanks for the topic. I am in the same situation right now.
Ionos dedicated server with Proxmox preinstalled image + 1 additional public IP.
My network config is the exact same as already discussed with:
- Linux VLAN eth0.<<public net vlan from ionos>>
- vmbr1 Linux bridge pointing to eth0.vlanid, no ip configured at host.
- VM using vmbr1 with public IP from Ionos.
I have outgoing traffic with the secondary IP, but incoming traffic is not routed. I verified that with tcpdump on eth0 on the proxmox host. Outgoing traffic is logged, but no incoming.
Is there something additional that needs to configured on the Ionos Cloud Panel? Right now it looks like it is blocked by a Firewall or not even routed to my server from Ionos. But since I am a first time Ionos user, I am not sure if it due to my Network config or on Ionos side / Cloud Panel.
Hi Amari,
First, two things that made me loosing time...
Did you reboot the Proxmox server ? Unfortunately, this seems to be mandatory on Ionos when you assign a new IP address to a public network.
Did you configure a firewall on Ionos ? Again, surprisingly I got strange behavior without one...
Here's my working configuration.
On Ionos cloud panel, I configured :
- A server... let's name its default IP address <HOST_IP>
- A public network with the server inside, and got the VLAN ID (named <VLAN_ID> below)
- A secondary IPv4 address, and assigned it to the public network (named <SECOND_IP> below)
- A firewall for accessing Proxmox, with ports 22 and 8006, assigned to <HOST_IP>
- A firewall for accessing VMs, assigned to the public network, and with needed ports, assigned to public network
- A VPN, to secure Proxmox host access, with IP address <VPN_ADDRESS>
On Proxmox, here's the /etc/network/interfaces
Code:
source /etc/network/interfaces.d/*
auto lo
iface lo inet loopback
# The eth0 interface
allow-hotplug eth0
iface eth0 inet dhcp
iface eth1 inet manual
auto eth0.<VLAN_ID>
iface eth0.<VLAN_ID> inet manual
vlan-raw-device eth0
# Interface WAN for OpnSense
auto vmbr1
iface vmbr1 inet manual
bridge-ports eth0.<VLAN_ID>
bridge-stp off
bridge-fd 0
# Bridge LAN (internal VMs)
auto vmbr0
iface vmbr0 inet static
address 10.10.10.254/24 # Internal Proxmox host address
bridge-ports none
bridge-stp off
bridge-fd 0
And the firewall configuration for allowing only VPN (duplicate lines if multiple IP addresses) (
/etc/pve/nodes/XXXXXX/host.fw)
Code:
[OPTIONS]
enable: 1
[RULES]
IN ACCEPT -source <VPN_ADDRESS> -dport 8006 -proto tcp
IN ACCEPT -source <VPN_ADDRESS> -dport 22 -proto tcp
IN DROP -dport 8006 -proto tcp
IN DROP -dport 22 -proto tcp
There was a default DHCP server configured on Proxmox (in Dnsmasq configuration as far as I remember), I disabled it because I prefer it on OpnSense.
OpsSense VM has two network interfaces, one on vmbr0 and one on vmbr1. All other Proxmox VMs will only be on vmbr0.
On Proxmox interface, I created a VM with a very light distribution (PuppyLinux), only to have a browser to access OpnSense. This VM is using DHCP. I also install network debugging tools on this VM.
Then I created a VM for a first service, let's name it <SERVICE_VM>, with a static IPv4 address
10.10.10.10 and gateway
10.10.10.1.
On OpnSense, I configured
- A gateway
10.255.255.1 named "WAN_GW"
- LAN on
vtnet1, with static IPv4 address
10.10.10.1/24
- WAN on
vtnet0, with static IPv4 address (secondary on created on Cloud panel) and WAN_GW as gateway (If you need more IP addresses to reach directly other VMs, add them to "Virtual IP" on OpnSense)
- A DHCP server with range
10.10.10.100 => 200
- NAT (Port forward) to send incoming packets destinated to <SECOND_IP> on
10.10.10.10 (SERVICE_VM), for the ports I need
- NAT (outbound) to assign the <SECOND_IP> on packets incoming from
10.10.10.10 (not mandatory if you have only one secondary IP)
Now you should access Proxmox with the original <HOST_IP>, using VPN if you configured it.
On BROWSER_VM :
- Check the DHCP server is working well, you should have
10.10.10.100 and gateway
10.10.10.1
- You should access internet
-
curl ifconfig.me should give you your secondary IP address
On SERVER_VM, quite the same but with a static IP. And you should reach SERVER_VM from the outside, using SECOND_IP, on ports allowed on Ionos firewall and forwarded in OpnSense.
If you still have problems, check with tcpdump on Proxmox host if you have packets incoming on the VLAN ID. You can also use packet capture on OpnSense, or NAT log files.
Tell me if you still have problems !
