1

I've got ProxmoxVE2.1 ruled KVM node on Debian and bunch of VM's guests machine. That is how my networking looks like:

# network interface settings
auto lo
iface lo inet loopback

# device: eth0
auto  eth0
iface eth0 inet static
    address   175.219.59.209
    gateway   175.219.59.193
    netmask   255.255.255.224
    post-up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp

And I've got two working subnet solution

auto vmbr0
iface vmbr0 inet static
    address   10.10.0.1
    netmask   255.255.0.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0
    post-up ip route add 10.10.0.1/24 dev vmbr0

This way I can reach internet, to resolve outside hosts, update and download everything I need but can't reach one guest VM out of any other VM's inside my network.

The second solution allows me to communicate between VM's:

auto vmbr1
iface vmbr1 inet static
    address   10.10.0.1
    netmask   255.255.255.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0
    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up iptables -t nat -A POSTROUTING  -s '10.10.0.0/24' -o vmbr1 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s '10.10.0.0/24' -o vmbr1 -j MASQUERADE

I can even NAT internal addresses:

-t nat -I PREROUTING -p tcp --dport 789 -j DNAT --to-destination 10.10.0.220:345

My inexperienced mind is ready to double VM's net adapters: one for the first solution and another - for second (with slightly different adresses) but I'm pretty sure that it's a dumb way to resolve the problem and everything can be resolved via iptables/ip route rules that I can't create.

UPDATE:

http://img685.imageshack.us/img685/3153/mytopo.png

1
  • iptables -t nat -A POSTROUTING ! -d '10.10.11.0/24' -j SNAT --to-source '175.219.59.209' ? Is it good way to resolve my problem if I append such rule?
    – Daniel
    Sep 10, 2012 at 2:29

1 Answer 1

0

Check out my configuration in my question here;

Debian: Should I add vlan interface into bridge for KVM?

I ended up using bridge interfaces that are bridged with the guests. My node can reach the Internet and its guests, and the guests can reach each other and the Internet, full connectivity. Fire-walling is done on each guest them.

1
  • A bit tricky for my imaginary topology. I'm not sophisticated in networking but is it working on one physical IP with no additional MAC subnet addresses applied via data center? I will update the question with my topology and would like your advise to choose or not to chose bonded solution with VLAN over possibly routed solution.
    – Daniel
    Sep 11, 2012 at 2:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .