Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got ProxmoxVE2.1 ruled KVM node on Debian and bunch of VM's guests machine. That is how my networking looks like:

# network interface settings
auto lo
iface lo inet loopback

# device: eth0
auto  eth0
iface eth0 inet static
    post-up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp

And I've got two working subnet solution

auto vmbr0
iface vmbr0 inet static
    bridge_ports none
    bridge_stp off
    bridge_fd 0
    post-up ip route add dev vmbr0

This way I can reach internet, to resolve outside hosts, update and download everything I need but can't reach one guest VM out of any other VM's inside my network.

The second solution allows me to communicate between VM's:

auto vmbr1
iface vmbr1 inet static
    bridge_ports none
    bridge_stp off
    bridge_fd 0
    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up iptables -t nat -A POSTROUTING  -s '' -o vmbr1 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s '' -o vmbr1 -j MASQUERADE

I can even NAT internal addresses:

-t nat -I PREROUTING -p tcp --dport 789 -j DNAT --to-destination

My inexperienced mind is ready to double VM's net adapters: one for the first solution and another - for second (with slightly different adresses) but I'm pretty sure that it's a dumb way to resolve the problem and everything can be resolved via iptables/ip route rules that I can't create.


share|improve this question
iptables -t nat -A POSTROUTING ! -d '' -j SNAT --to-source '' ? Is it good way to resolve my problem if I append such rule? – Daniel Sep 10 '12 at 2:29

Check out my configuration in my question here;

Debian: Should I add vlan interface into bridge for KVM?

I ended up using bridge interfaces that are bridged with the guests. My node can reach the Internet and its guests, and the guests can reach each other and the Internet, full connectivity. Fire-walling is done on each guest them.

share|improve this answer
A bit tricky for my imaginary topology. I'm not sophisticated in networking but is it working on one physical IP with no additional MAC subnet addresses applied via data center? I will update the question with my topology and would like your advise to choose or not to chose bonded solution with VLAN over possibly routed solution. – Daniel Sep 11 '12 at 2:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.