vmbr0 NAT does not pass Layer 3 traffic ? No DNS, but ICMP, ARP etc passes

[FakeNinja]

hey guys I'm trying to use the NAT setup with only 1 IP on my dedi box and the VM can't reach internet fully.
It can ping 1.1.1.1 for example but when I run tcpdump I can't see any HTTP communication, only ARP and Layer 2 protocols etc.
DNS doesn't resolve. The VM is a Windows 2022 machine with VirtIO network card driver. It has the vmbr0 interface selected.

I've added the conntrack fw rules to iptables in the network interface configuration but the issue persists

auto enp35s0
iface enp35s0 inet static
    address [REDACTED FOR PRIVACY]
    gateway [^]

auto vmbr0
iface vmbr0 inet static
    address 10.0.100.1/24
    bridge-ports none
    bridge-stp off
    bridge-fd 0
    post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up   iptables -t nat -A POSTROUTING -s '10.0.100.0/24' -o enp35s0 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s '10.0.100.0/24' -o enp35s0 -j MASQUERADE
    post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
    post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

What can be the issue?

 

[shrdlicka]

Hi,

have you configured some DNS server in your VM? Is your firewall active?

 

[FakeNinja]

Hi,

have you configured some DNS server in your VM? Is your firewall active?

I point to Google and Cloudflare DNS, both are pingable from inside the VM.
I've disabled all firewalls

This is on Hetzner.