Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i want to create a VLAN for 3 guest VMs. I already have it and every VM can ping each other, but the problem is that any guest CAN NOT have access to Internet

Network configuration in Host machine

# /etc/network/interfaces
auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
    address 188.165.x.x            <------ Internet's public ip
    netmask 255.255.255.0
    network 188.165.255.0
    broadcast 188.165.255.255
    gateway 188.165.y.y            <------- Internet's public gateway
    bridge_ports eth0
    bridge_fd 0
    bridge_stp on

auto eth0.3
iface eth0.3 inet manual
        mtu 1500
        vlan_raw_device eth0

auto vlan3
iface vlan3 inet static
        bridge_ports eth0.3
        bridge_maxwait 0
        bridge_stp off
        address 172.69.0.1
        netmask 255.255.255.0
        network 172.69.0.0
        broadcast 172.69.0.255

Route list in Host machine route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.69.0.0      0.0.0.0         255.255.255.0   U     0      0        0 vlan3
188.165.255.0   0.0.0.0         255.255.255.0   U     0      0        0 br0
0.0.0.0         188.165.y.y 0.0.0.0         UG    0      0        0 br0

brctl showHost machine

bridge name bridge id       STP enabled interfaces
br0     8000.e840f20acc28   yes     eth0
                            tap10.0
                            vif10.0
                            vif7.0
vlan3   8000.e840f20acc28   no      eth0.3
                                    log01

Ping guest -> host working

PING 172.69.0.1 (172.69.0.1) 56(84) bytes of data.
64 bytes from 172.69.0.1: icmp_req=1 ttl=64 time=0.155 ms
64 bytes from 172.69.0.1: icmp_req=2 ttl=64 time=0.100 ms

Traceroute to, for example, Google's DNS ip

traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  172.69.0.1 (172.69.0.1)  0.198 ms  0.237 ms  0.209 ms
 2  * * *

As you can see, it dies in host ip (gateway).

I don't know what I am doing wrong

share|improve this question
1  
Is IP forwarding enabled? (cat /proc/sys/net/ipv4/ip_forward)? Have you configured NAT on the host? –  mgorven Oct 24 '12 at 18:45
    
yes, it is enabled –  JavierMartinez Oct 24 '12 at 19:37

1 Answer 1

up vote 1 down vote accepted

You need to enable IP-forwarding by changing /proc/sys/net/ipv4/ip_forward to 1.

You also need to apply an iptables-rule to NAT the VMs. (This should be applied on the host)

iptables -t nat -A POSTROUTING -o <your external interface on the Host> -j MASQUERADE
share|improve this answer
    
working with iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE THANKS!!! –  JavierMartinez Oct 25 '12 at 7:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.