[SOLVED] Sorry another how to port forwarding?

[sasodysseus]

Hello

First of all I'm sorry because I'm sure I'm asking another variation of the same question that you all see , but I couldn't find something to help me.

I'm coming from a dev/QA tester background, I discovered ProxMox and I thought "what a nice tool for my game servers". I do web and python dev, I know how to install and deploy my discord bots, game servers, web servers, on Ubuntu, I know how to forward ports on my home router. I have a "ok" understanding of the technical context. I decided to fallow a tutorial.

I have installed ProxMox 8.3.4 on a monthly paid dedicated with a single IP, and I plan to use it with a private network for the VMs and a portforwarding rule to get to them. For now the setup is incomplete and I know about the bad practices especially reachable 8006, its planned to setup a VPN, etc. but right now I'm trying just to get the understanding of the tool. I'm at my 5 or 6th re-install so I'm a bit fed up and just do the minimum once I get the understanding; then another reinstall and I'll make everything clean.


Right now as an exercise I'm trying to get access SSH access to a Ubuntu server using public_ip_v4:22100 forwarded to 10.10.10.100:22. Because its time consuming to setup the game app so I'm making the exercise with SSH instead. Later I'll replace WAN:22100 => LAN:22 with WAN:25565 => LAN:25565.

Network rerouting in /etc/network/interfaces ;

[...]
auto vmbr0
iface vmbr0 inet static
        address 10.10.10.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0
        hwaddress xx:xx:xx:xx:xx:xx

        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1np0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1np0 -j MASQUERADE
        post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
        post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

Network interfaces are configured so both are active and with autostart true ;

• eno1np0 (WAN)
  • IPv4/CIDR : PublicIPv4/24
  • IPv4GW : PublicIPv4GW
  • IPv6/CIDR : PublicIPV6/64
  • IPv6GW : PublicIPv6GW
• vmbr0 (LAN)
  • IPv4/CIDR : 10.10.10.0/24

I'm only using Proxmox tooling (haven't added something like pfSense)
Gateway is 10.10.10.1
VM is 10.10.10.100

Firewall is enabled at all levels (Datacenter, Node, VM, ubuntu ufw enable + allow ssh)

Datacenter input policy is DROP, output and forward are ACCEPT
VM input and output policies are ACCEPT.

On Datacenter I have allowed myself 8006, allowed non-22 SSH port for debian, and allowed ICMP for ping with macro.

Ubuntu 10.10.10.100 can ping 8.8.8.8 and ping google.com, and can apt update/upgrade.
When I connect from my PC to proxmox debian as root I can SSH into 10.10.10.100.
From 10.10.10.100 I can ping PublicIPv4/24 and PublicIPv4GW. And from PublicIPv4/24 I can ping 10.10.10.1 and 10.10.10.100

On the debian host I also added

I have tried many things to forward PublicIPv4:22100 to 10.10.10.100:22 using the proxmox UI only but there is something I fail somewhere certainly on a basic thing.

Could you help me please? And again sorry

 

[shanreich]

The setting in your network configuration only applies to outgoing traffic, if you want to forward a port to a VM for incoming traffic you need to use DNAT:

iptables -t nat -A PREROUTING -i eno1np0 -p tcp --dport 22100 -j DNAT --to 10.10.10.100:22

 

[sasodysseus]

Oh that was that , but I tried it also but somehow I was doing it wrong, thanks a lot

I added the post-up A/post-down D of it, rebooted the whole machine, and that was working

So to share the extract of the file with the last lines on how to forward WAN(eno1np0):22100 => LAN(vmbr0)10.10.10.100:22

auto vmbr0
iface vmbr0 inet static
        [...]

        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1np0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1np0 -j MASQUERADE
        post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
        post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

        # Port forwarding
        post-up   iptables -t nat -A PREROUTING -i eno1np0 -p tcp --dport 22100 -j DNAT --to 10.10.10.100:22
        post-down iptables -t nat -D PREROUTING -i eno1np0 -p tcp --dport 22100 -j DNAT --to 10.10.10.100:22

But then, if I configure it by iptables, what use do I have for the Proxmox/Node/VM firewall rules? How should I use them in my setup in parralel of iptables?

 

[shanreich]

But then, if I configure it by iptables, what use do I have for the Proxmox/Node/VM firewall rules? How should I use them in my setup in parralel of iptables?

The firewall is using the filter chains for filtering traffic, NAT is an independent table in netfilter and currently not used by the proxmox firewall

 

[sasodysseus]

Thanks !

How do I mark the post as resolved?

Edit : Found it in "edit thread"