Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i want to create a VLAN for 3 guest VMs. I already have it and every VM can ping each other, but the problem is that any guest CAN NOT have access to Internet

Network configuration in Host machine

# /etc/network/interfaces
auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
    address 188.165.x.x            <------ Internet's public ip
    gateway 188.165.y.y            <------- Internet's public gateway
    bridge_ports eth0
    bridge_fd 0
    bridge_stp on

auto eth0.3
iface eth0.3 inet manual
        mtu 1500
        vlan_raw_device eth0

auto vlan3
iface vlan3 inet static
        bridge_ports eth0.3
        bridge_maxwait 0
        bridge_stp off

Route list in Host machine route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   U     0      0        0 vlan3   U     0      0        0 br0         188.165.y.y         UG    0      0        0 br0

brctl showHost machine

bridge name bridge id       STP enabled interfaces
br0     8000.e840f20acc28   yes     eth0
vlan3   8000.e840f20acc28   no      eth0.3

Ping guest -> host working

PING ( 56(84) bytes of data.
64 bytes from icmp_req=1 ttl=64 time=0.155 ms
64 bytes from icmp_req=2 ttl=64 time=0.100 ms

Traceroute to, for example, Google's DNS ip

traceroute to (, 30 hops max, 60 byte packets
 1 (  0.198 ms  0.237 ms  0.209 ms
 2  * * *

As you can see, it dies in host ip (gateway).

I don't know what I am doing wrong

share|improve this question
Is IP forwarding enabled? (cat /proc/sys/net/ipv4/ip_forward)? Have you configured NAT on the host? – mgorven Oct 24 '12 at 18:45
yes, it is enabled – blacksoul Oct 24 '12 at 19:37
up vote 1 down vote accepted

You need to enable IP-forwarding by changing /proc/sys/net/ipv4/ip_forward to 1.

You also need to apply an iptables-rule to NAT the VMs. (This should be applied on the host)

iptables -t nat -A POSTROUTING -o <your external interface on the Host> -j MASQUERADE
share|improve this answer
working with iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE THANKS!!! – blacksoul Oct 25 '12 at 7:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.