2

I have a server with my own public /28 IPv4 Network.

On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every vServer has a private (192.168.x.y/24) address and not every vServer should get a public IP.

The host routes the public IPs to their specific vServer, which is working great on incoming connections.

My problem: on outgoing connections from the vServers they get the sender IP from the host and not their public one. Is there any way to set a public sender IP for a vServer in libvirt?

I've already searched ServerFault, but didn't really find anything. But I have to admit, I may not know the best search terms for this.

2
  • For the VMs that do have a public IP, why not use a bridge instead of NAT? wiki.libvirt.org/page/Networking
    – sciurus
    Jul 7, 2014 at 2:03
  • I can't do bridging because Hetzner has switches with Port Security and they won't let me define more MAC-Addresses :/
    – LittleFox
    Jul 7, 2014 at 13:16

1 Answer 1

0

To set up the NAT on your virtual network libvirt is adding some iptables rules that look something like this:

$ iptables -t nat -S
[...]
-A POSTROUTING -s 192.168.1.0/24 ! -d 192.168.1.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.1.0/24 ! -d 192.168.1.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.1.0/24 ! -d 192.168.1.0/24 -j MASQUERADE
[...]

The MASQUERADE actions in these rules are translating the internal IP to the external IP of your NIC. There is another action called SNAT that does the same thing but uses a specific source ip you set yourself. So what you can do is insert some SNAT rules before your MASQUERADE rules like this:

$ iptables -t nat -I POSTROUTING -s 192.168.1.x ! -d 192.168.1.0/24 -j SNAT --to-source <public ip>
$ iptables -t nat -I POSTROUTING -s 192.168.1.x ! -d 192.168.1.0/24 -p udp -j SNAT --to-source <public ip>:1024-65535
$ iptables -t nat -I POSTROUTING -s 192.168.1.x ! -d 192.168.1.0/24 -p tcp -j SNAT --to-source <public ip>:1024-65535

Now the outgoing traffic from 192.168.1.x will get a source ip of <public ip>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .