VMs on second bridge not working

[cvonfeldt]

I wanted to configure a second network for some Windows Domain stuff - and have it isolated from other VMS and the rest of the network.
But also have internet access.

I've been following this doc. but havent been able to get VMs to get out from behind the second bridge.

what have I done wrong?

 

[ggoller]

Hi!
you route vmbr1 to eno1 and vmbr0 to eno3 – is that intended? Also check if your eno1 interface works. Check if the firewall is enabled as well; note that it defaults to drop packets. (https://pve.proxmox.com/wiki/Network_Configuration#sysadmin_network_masquerading.)

 

[cvonfeldt]

Thanks for the speedy reply!
Proxmox chose eno3 for the default bridge - dont know why.
i've switched between the other three available. I'm pretty sure eno4 is up given this dump:



I hadnt thought about the firewall. I'm new to proxmox, so I'll have to read a bit.

thanks again!

 

[cvonfeldt]

i disabled firewall - no help.
I must have incorrect masquerading.

​

 

[ggoller]

Hi!
try using 'vmbr0' in both iptables commands, so that your traffic gets masqueraded through vmbr0 (which is, I assume, what you want). Because in the current setup with the 'bridge-ports eno1' the whole traffic flows directly to eno1 (which has the same ip address as vmbr1, as it's the bridges slave port).

 

[cvonfeldt]

i disabled firewall - no help.
I must have incorrect masquerading.

​

 

[cvonfeldt]

changed to:
_____________________________________________________________________________

auto vmbr0
iface vmbr0 inet static
address 192.168.10.6/24
gateway 192.168.10.1
bridge-ports eno3
bridge-stp off
bridge-fd 0
#Default Bridge

auto vmbr1
iface vmbr1 inet static
address 192.168.20.1/24
bridge-ports eno4
bridge-stp off
bridge-fd 0
#Windows Domain

post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '192.168.20.0/24' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.20.0/24' -o vmbr0 -j MASQUERADE
post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

________________________________________________________________________________

also tried
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '192.168.20.0/24' -o eno3 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.20.0/24' -o eno3 -j MASQUERADE
post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

root@Proxmox-R620:~# vi /etc/network/interfaces
root@Proxmox-R620:~# systemctl restart networking

 

[cvonfeldt]

kind of a strange thing. a VM behind vmbr1 get DHCP - which i would expect, i suppose.

 

[cvonfeldt]

otherwise, Im' still unable to get this working.

 

[ggoller]

Hmm it should work though... If you use vmbr0 on the VM, do your packets get out? Also it's better if you use ifreload -a to reload the network config (If you're using systemctl reload, you'd also need to flush it first).

 

[cvonfeldt]

Thanks! I did not know that! I come from a much older version of the matrix.