Throubles enabling ipv4 forwarding

[Francesco Piraneo G.]

Hi all,
I have two fully virtualized guests, both debian 10.
The first guest has two nic, one with a public ip and the second with an internal only network (10.10.10.10/8) both on different vmbr: first eth0 with public ip on vmbr0 and second eth1 - local only on vmbr1.
The second guest has just one nic eth0 with a local only ip address (10.10.10.11/8).
On first machine I've enabled the ip_forwarding flag on sysctl.conf and I'm sure that is enabled (several reboots, cat /proc/sys/net/ipv4/ip_forwarding says 1).
Of course the first guest is online and network activity is ok!

The problem: On the second guest trying a simple ping to google dns 8.8.8.8 (same for 1.1.1.1) doesn't receive any answer and of course any network activity is down, except pinging the router guest (ping 10.10.10.10 is ok).

I dig further on the router guest (the guest with two nics) making a tcpdump and the result is:



So it seems that the ping request leave the machine but google simply drop the request because he doesn't know where to send back the answer... this is my thought!

On my mac I did the same and you know the result:

15:15:06.991296 IP 192.168.1.22 > dns.google: ICMP echo request, id 35842, seq 3, length 64
15:15:07.012605 IP dns.google > 192.168.1.22: ICMP echo reply, id 35842, seq 3, length 64
15:15:07.993347 IP 192.168.1.22 > dns.google: ICMP echo request, id 35842, seq 4, length 64
15:15:08.016326 IP dns.google > 192.168.1.22: ICMP echo reply, id 35842, seq 4, length 64

Any hint is welcome. Here follows some useful informations like the configurations of both guests (192.168.1.240 is the lan address then routed to public network via ADSL router):




Offline guest:




EDIT:
I make a tcpdump also on the host and I can confirm that the packets leave the host machine:

root@vmhost00:~# tcpdump -i enp0s8 dst 8.8.8.8
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s8, link-type EN10MB (Ethernet), capture size 262144 bytes
18:23:32.572916 IP 10.10.10.11 > dns.google: ICMP echo request, id 386, seq 64, length 64
18:23:33.596736 IP 10.10.10.11 > dns.google: ICMP echo request, id 386, seq 65, length 64
18:23:34.620752 IP 10.10.10.11 > dns.google: ICMP echo request, id 386, seq 66, length 64
18:23:35.644697 IP 10.10.10.11 > dns.google: ICMP echo request, id 386, seq 67, length 64
18:23:36.668670 IP 10.10.10.11 > dns.google: ICMP echo request, id 386, seq 68, length 64

...but nothing is returned!

Thank you very much for any hint.

Francesco

 

[Stoiko Ivanov]

if the packets have a private (10.0.0.0/8) ip - you need to NAT them out?
see the reference documentation:
https://pve.proxmox.com/pve-docs/ch..._nat_with_span_class_monospaced_iptables_span

 

[Francesco Piraneo G.]

Adding these three lines at the local interface on the router machine seems to be enough.

post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE

 

[Stoiko Ivanov]

did that solve your problem?

if yes please mark the thread as 'SOLVED'

Thanks!