0

I have installed PVE, I received three public Ip address two of them are in the same range, the third one is in different range. I wanted to give PVE host one pub IP to be reachable externally, and the other two to VMs I also wanted to created two VMs with private IP address and make port forwarding. below is my configuration:

auto lo

iface lo inet loopback

auto eth0
iface eth0 inet static

address  x.x.203.141
netmask  255.255.255.128
pointopoint x.x.203.137
gateway  x.x.203.137
broadcast  x.x.203.255
#post-up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp


iface eth1 inet manual

    auto vmbr0
    iface vmbr0 inet static

    address x.x.203.141
    netmask 255.255.255.128
    #gateway x.x.203.137
    bridge_ports none
    bridge_stp on
    bridge_fd 0
    bridge_maxwait 0



   iface vmbr1 inet manual
    bridge_ports none
    bridge_stp on
    bridge_fd 0

up ip route add x.x.203.142/32 dev vmbr0  ##IP of the first VM
up ip route add x.x.220.37/32 dev vmbr1   ## IP of the second VMS

auto vmbr2

iface vmbr2 inet static

address 192.168.0.254
netmask 255.255.255.0
bridge_ports none
bridge_stp on
bridge_fd 0

post-up echo 1 > /proc/sys/net/ipv4/ip_forward

post-up iptables -t nat -A POSTROUTING -s '192.168.0.0/24' -o eth0 -j MASQUERADE

post-down iptables -t nat -D POSTROUTING -s '192.168.0.0/24' -o eth0 -j MASQUERADE

yet I am losing ping externally to the host machine. and also with the second VMs which has Public IP with a different range I have a very slow internet? another thing is that I am not able to ssh to the VM with private IP address externally.

Thanks for your help in advance!

  • Can you please show debian network config (/etc/network/interfaces) in normal readable form, formatted exactly like it looks in the, say, vim? It is hard to help when it is hard to read and understand. Also, this looks like nat-routing issue for me. Do you have two different ISPs connected to different physical interfaces with their different next-hop addresses? Or do you have something like Hetzner provides - one IP and three others in different range, still we have one single ISP and one single next hop? – Nikita Kipriyanov Mar 5 '16 at 10:03
  • thanks for reply, I have one ISP (three public IP) two of them are in the same range and x.x.203.141 (assigned to proxmox host) and x.x.203.142 supposed to be assined to one of the VMs. this range of Ip conected to eth0 on host. another Pub IP (x.x.220.38 connected to eth1 on host) supposed to go for the second VM – Nashwan Surchi Mar 5 '16 at 13:08
  • You still haven't bothered to provide /etc/network/interfaces in readable form. I hardly can understand the mess as you presented it. Look, some multi-lines are joined into a single line, some pound characters triggered spurious markdown headers and so on. This is really important, I even think other people don't try to help you only because they can't read your provided config. The complete file contents should be in a single code block, for this to achieve you have to indent each line of the file by four characters more than is it already indented in a file. – Nikita Kipriyanov Mar 5 '16 at 19:38
  • @NikitaKipriyanov the question is in readable form, would be grateful if you can see where us the problem. thanks – Nashwan Surchi Mar 6 '16 at 12:40
0

The easiest way to achieve this is to give white (public) IPs to VMs via bridging (not proxy-arp). You will still be able to firewall traffic for all VMs on the host, because netfilter in Linux supports checking bridge traffic with iptables rules.

In this case the config will probably look like this:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet manual

auto vmbr0
iface vmbr0 inet static
    address  x.x.203.141
    netmask  255.255.255.128
    pointopoint x.x.203.137
    gateway  x.x.203.137
    broadcast  x.x.203.255
    bridge_ports eth0
    bridge_stp off
    bridge_fd 0
    bridge_maxwait 0

auto eth1
iface eth1 inet manual

auto vmbr1
iface vmbr1 inet manual
    bridge_ports eth1
    bridge_stp off
    bridge_fd 0

auto vmbr2
iface vmbr2 inet static
    address 192.168.0.254
    netmask 255.255.255.0
    bridge_ports none
    bridge_stp off
    bridge_fd 0
    post-up echo 1 > /proc/sys/net/ipv4/ip_forward
    post-up iptables -t nat -A POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE
    post-down iptables -t nat -D POSTROUTING -s '192.168.0.0/24' -o vmbr0 -j MASQUERADE

You have to put VM which should appear on eth0 into vmbr0, the VM which should appear on eth1 into vmbr1, and everything else is going to vmbr2, any traffic from that network will be masqueraded. Note vmbr1 doesn't have any IP address, it doesn't need any, because the sole purpose of that bridge is to link eth1 and VM virtual interface. All host communication is done via vmbr0.

I don't know why you added 'pointtopoint' keyword for eth0. I retained it in the vmbr0; still I think this is a mistake and it is not needed. You have BMA network on eth0 with mask /25, it has 128 addresses (126 usable), so 'pointtopoint' (which means you have only one peer) looks wrong there. I also disabled stp in all bridges. There isn't much use of it, because you will not bridge any interfaces which are connected elsewhere.

In any case, tcpdump is your best friend.

You can set up proxy-arp instead of bridging first VM (which appear on eth0). I think this will make things less robust and I suggest you not going this way.

From your description I deduce your host should only have one IP address, and that address should be seen on eth0, so eth1 will be unnumbered in the host (shouldn't have any address), only VM address will appear there. I don't know, if it is possible to set up proxy-arp and routing in Linux on unnumbered interface (the one without any IP address), so to clarify this part I need to do some investigation on my own.

  • Thank you very much for your reply, this sounds cool, but I am facing one problem with in this setting, when I restart network setting of the hosting node, I am not able to ping the first VM connected to the vmbr0, means I am losing routing. What do you think if I define a new white bridge just vmbr1 and connect the VM1 to that bridge? I mean my only concern right now is why after networking restart of the host machine a disruption happen to the first VM?!! thank you again – Nashwan Surchi Mar 7 '16 at 6:09
  • This is probably the effect of pointtopoint. The "pointtopoint addr" basically says "there is only one peer node on this interface, it has address addr". – Nikita Kipriyanov Mar 9 '16 at 6:57
  • Thank you very much, I do appreciate your help and support. – Nashwan Surchi Mar 9 '16 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.