My setup is a VM host with two network interfaces where I want to use one as private/internal and the other one as public (which will get a public address on the host), where all the NAT magic to the guest machines will happen.
Two interfaces means two gateways (one via
eth0, 10.0.0.1 and the fake address on
If I understood routing correctly, I have to setup a routing table for the
188.8.131.52 network with its own default gateway. Unfortunately guest's traffic can't be routed unless I add a default gateway to the default table on the host. I want the host to use
10.0.0.1 as its default gateway, but I have no idea how to do that.
Specifically, I'd like to get rid of
default via 184.108.40.206 dev eth1 on the host, but if I remove it, the
tcpdump -i vbr0 doesn't look too good (trying to lookup serverfault.com from a guest in the example below):
IP 192.168.10.2.32804 > 220.127.116.11.domain: 41116+ A? serverfault.com. (24) IP 192.168.10.1 > 192.168.10.2: ICMP net 18.104.22.168 unreachable, length 60
Still, the guest is able to reach
192.168.10.1 (its gateway) and
22.214.171.124. Moreover, using
126.96.36.199 to lookup an address (that router has a DNS service as well) from the guest works, so local routing seems to work, "only" the default gateway part seems to be messed up somehow.
Shouldn't all traffic from guest (or vb0) use the default gateway
188.8.131.52, as defined in the routing table "public"?
# ip route default via 184.108.40.206 dev eth1 10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.15 220.127.116.11/24 dev eth1 proto kernel scope link src 18.104.22.168 192.168.10.0/24 dev vbr0 proto kernel scope link src 192.168.10.1 # ip route show public default via 22.214.171.124 dev eth1 126.96.36.199/24 dev eth1 scope link src 188.8.131.52 192.168.10.0/24 dev vbr0 scope link src 192.168.10.1 # ip rule 0: from all lookup local 32761: from 192.168.10.1 lookup public 32762: from all to 192.168.10.1 lookup public 32763: from all to 184.108.40.206 lookup public 32765: from 220.127.116.11 lookup public 32766: from all lookup main 32767: from all lookup default # iptables -vnL Chain INPUT (policy ACCEPT 1222 packets, 91256 bytes) pkts bytes target prot opt in out source destination 13 648 REJECT all -- * * 0.0.0.0/0 18.104.22.168 reject-with icmp-port-unreachable Chain FORWARD (policy ACCEPT 193 packets, 297K bytes) pkts bytes target prot opt in out source destination 266 51860 ACCEPT all -- * * 0.0.0.0/0 192.168.10.0/24 ctstate NEW,RELATED,ESTABLISHED Chain OUTPUT (policy ACCEPT 1157 packets, 149K bytes) pkts bytes target prot opt in out source destination Chain LOGDROP (0 references) pkts bytes target prot opt in out source destination # iptables -vnL -t nat Chain PREROUTING (policy ACCEPT 49 packets, 5494 bytes) pkts bytes target prot opt in out source destination 6 360 DNAT tcp -- * * 0.0.0.0/0 22.214.171.124 tcp dpt:80 to:192.168.10.2:80 0 0 DNAT tcp -- * * 0.0.0.0/0 126.96.36.199 tcp dpt:443 to:192.168.10.2:443 1 60 DNAT tcp -- * * 0.0.0.0/0 188.8.131.52 tcp dpt:22022 to:192.168.10.2:22 Chain INPUT (policy ACCEPT 24 packets, 3414 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 5 packets, 317 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 12 packets, 737 bytes) pkts bytes target prot opt in out source destination 5 318 SNAT all -- * * 192.168.10.2 0.0.0.0/0 to:184.108.40.206