[SOLVED] Route specific trafic when host have multiple public IPs

[Hades_Corps]

Hi,

I purchased a second IP for my dedicated and would like to route web trafic through it. So far I can ping the second IP but cannot get to Caddy reverse proxy. I would like all VM and CT to be masquerated as IP_1 currently but Caddy CT should be on IP_2 both way.
Thanks.

auto lo
iface lo inet loopback

auto enp36s0f0
iface enp36s0f0 inet static
        address <IP_2>/24
        gateway <GWv4>

auto enp36s0f0:0
iface enp36s0f0:0 inet static
        address <IP_2>/24

iface enp36s0f0 inet6 static
        address <IPv6>/64
        gateway <GWv6>

iface enx7640bbc96cdf inet manual

iface enp36s0f1 inet manual

auto vmbr0
iface vmbr0 inet static
        address 10.0.1.1
        netmask 255.255.255.0
        bridge-ports none
        bridge-stp off
        bridge-fd 0

        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up iptables -t nat -A POSTROUTING -o enp36s0f0 -j MASQUERADE
        post-up iptables -t nat -A PREROUTING -d <IP_1> -p tcp --dport 80 -j DNAT --to <Nextcloud>:80
        post-up iptables -t nat -A PREROUTING -d <IP_1> -p tcp --dport 443 -j DNAT --to <Nextcloud>:443
        post-up iptables -t nat -A PREROUTING -d <IP_1> -p tcp --dport 3478 -j DNAT --to <Nextcloud>:3478
        post-up iptables -t nat -A PREROUTING -d <IP_1> -p udp --dport 3478 -j DNAT --to <Nextcloud>:3478
        post-up iptables -t nat -A PREROUTING -d <IP_2> -p tcp --dport 80 -j DNAT --to <Caddy>:80
        post-up iptables -t nat -A PREROUTING -d <IP_2> -p tcp --dport 443 -j DNAT --to <Caddy>:443

Or should I forgo all of this and install a OPNSense VM to route all trafic? I afraid it might increase respond time too much.

 

[Hades_Corps]

Can anyone help me?

Is this too obvious but non-IT-background like I am could not see?

 

[Hades_Corps]

I found the solution, this part need to be changed:

        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up iptables -t nat -A POSTROUTING -o enp36s0f0 -j MASQUERADE

To:

        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -o enp36s0f0 -j MASQUERADE

Source was missing from the masquerade rule, while it still give CTs and VMs network, it does not work for multi-IP setup.