I'm trying (and having a hard time) to setup a clean KVM environment with: an Ubuntu (20.04) host (with a single NIC), multiple ubuntu KVM guests, 2 public IPs, and one Vlan per IP. Basically something looking like:
My needs are:
- I have 2 public IP addresses attached to my host NIC
- I want 2 VLANs for my guests and no communication between machines on different VLANs
- Each VLANs attached to one public IP
- All guests having at least access to internet, but not necessarily being accessible from outside ("one way", classic NAT?)
- Some guest acting as deamons/servers, being accessible from the internet ("two way", port redirection?)
- The host should still be able to access internet
- Ever having only 2 (one per IP) mac addresses advertised outside my host (to my provider's router)
I didn't find any online resources about how to achieve this architecture and none of my attempts
have yet been successful. I think I can achieve it with the right combination of bridge and (NAT) VLAN but some of my research indicated that I might need routing with Iptables.
Is it possible to achieve this structure and, if yes, how?
- for the host network config (neptlan ,ifup, iptable, etc)
- and the libvirt config (virsh xml)
To make my needs more clear:
Traffic from 0.0.0.0/0 destined to X.X.X.X on port 443 must be forwarded to VM1 in VLAN-1 Traffic from 0.0.0.0/0 destined to X.X.X.X on port 5432 must be forwarded to VM2 in VLAN-1 Traffic from 0.0.0.0/0 destined to Y.Y.Y.Y on port 443 must be forwarded to VM3 in VLAN-2 Traffic from VM1 in VLAN2 destined to 0.0.0.0/0 on any port must be routed through Y.Y.Y.Y ?