routeback issue

[markuman]

I got 1 public IP and all vms are in a simple nat network 10.10.0.0/16.
Every vm has internet access.
But what does not work is, when a vm oder the proxmox server itself tries to request the server with it's public ip/dns record.

external: $ curl my.domain.tld # works fine

vm: $ curl my.domain.tld
connection refused

proxmox: $ curl my.domain.tld
connection refused

the tcp dump looks like that

10:40:57.917200 IP 135.1.2.91.43780 > 135.1.2.91.80: Flags [S], seq 1875519961, win 65495, options [mss 65495,sackOK,TS val 3335870689 ecr 0,nop,wscale 7], length 0
10:40:57.917209 IP 135.1.2.91.80 > 135.1.2.91.43780: Flags [R.], seq 0, ack 1875519962, win 0, length 0

any ideas what went wrong?

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback
iface lo inet6 loopback

auto enp35s0
iface enp35s0 inet static
  address 135.1.2.91
  netmask 255.255.255.192
  gateway 135.1.2.65
  # route 135.1.2.64/26 via 135.1.2.65
  up route add -net 135.1.2.64 netmask 255.255.255.192 gw 135.1.2.65 dev enp35s0

iface enp35s0 inet6 static
  address 2a01:4f8:4a:3f11::2
  netmask 64
  gateway fe80::1

## Example of private network
auto vmbr0
iface vmbr0 inet static
    address 10.10.0.1
    netmask 16
    bridge_ports none
    bridge_stp off
    bridge_fd 0

    ##Allow IP Forwarding
    post-up echo 1 > /proc/sys/net/ipv4/ip_forward  
   
    ##Internet 4 all VMs    - Outgoing
    post-up iptables -t nat -A POSTROUTING -s '10.10.0.0/16' -o enp35s0 -j MASQUERADE
   
    ##Allow SSH - Incoming
    post-up iptables -t nat -A PREROUTING -i enp35s0 -p tcp --dport 80 -j DNAT --to 10.10.1.2:80


    ## Delete all NAT rules
    post-down iptables -t nat -D POSTROUTING -s '10.10.0.0/16' -o enp35s0 -j MASQUERADE  
    post-down iptables -t nat -D PREROUTING -i enp35s0 -p tcp --dport 80 -j DNAT --to 10.10.1.2:80

 

[markuman]

I just enabled ipv6, which solves the entire problem.

 

[Ramalama]

yeah, because your ipv6 doesn't have any firewall configured
for vm's inside your nat, you need probably to configure hairpin nat, but i know only how to do this with pf/opnsense, not with iptables.

for the proxmox host itself... add simply your domain name to the 127.0.0.1 entry in etc/hosts.
Else it goes through your firewall, which blocks the traffic.