I have one host running Proxmox VE.
I set up 3 virtual bridges
vmbr[0-2] to handle my networking needs:
vmbr0 runs directly on the main interface for VMs with public IPs,
vmbr1 allows for NATed VMs, and
vmbr2 is a host-only network.
Let's say my main public IP is 188.8.131.52.
For the NAT to work, I set up the following
-A PREROUTING -d 184.108.40.206 -i vmbr0 -p tcp -m multiport --dports 80,443 -j DNAT --to-destination 192.168.1.101 # and other rules like this one for different ports to different local IPs -A POSTROUTING -s 192.168.10.0/24 -o vmbr0 -j SNAT --to-source 220.127.116.11
Now let's say I have a VM on
vmbr1 with IP 192.168.1.102.
This machine cannot access the webserver at 192.168.1.101 using the public IP 18.104.22.168.
I initially thought that the
POSTROUTING directive above was enough for hairpin NAT to work.
Having read the canonical Loopback to forwarded Public IP address from local network - Hairpin NAT and multiple other answers on the same variant, I tried :
-P [INPUT|FORWARD|OUTPUT] ACCEPTtemporarily on the host to check if it could be caused by some filtering rules
-A POSTROUTING -d 192.168.1.101 -p tcp --dport 80 -j MASQUERADEto the ruleset, trying it both before and after the current
but still, it does not work.