0

I have a server running Windows Server 2012 R2, with one physical NIC and some Hyper-V VMs. The host has 3 external IP addresses. I've configured a Hyper-V switch on the host, assigned this a a static IP on the host, and connected a VM to this switch as well.

I'd like to be able to configure NAT on the host so that I can assign 2 of the 3 external IP addresses to have their traffic sent to the Hyper-V switch, and have the VM attached to this switch receive this traffic.

The external IPs in this senario are:

  • 10.1.1.1
  • 10.1.2.1
  • 10.1.3.1

NOTE: The actual IPs assigned are not in the same subnet. They were purchased at seperate times as single IPs.

10.1.1.1 is the primary IP address for the server. 10.1.2.1 and 10.1.3.1 are additional IP addresses I have purchased and assigned to the same NIC as 10.1.1.1.

The IP address on the host, assigned to the NIC connected to the Hyper-V switch is:

  • 192.168.1.1

On the VM, the IP address assigned to the NIC connected to the Hyper-V switch is:

  • 192.168.1.100

I'm familiar with getting a setup like this running in Linux, but have never done this on Windows. I would normally accomplish this by setting up a virtual adapter, eth0:1, and assigning it the IP address 10.1.2.1 to it. Then apply the following iptables rules:

-A FORWARD -i eth0:1 10.1.2.1 -m state --state NEW -j ACCEPT
-A PREROUTING --destination 10.1.2.1 -j DNAT --to-destination 192.168.1.1
-A POSTROUTING -s 192.168.1.0/24 -j SNAT --to 10.1.2.1

I've followed a guide from Dell for setting up a Windows Server 2012 R2 machine as a router - found here: http://www.dell.com/support/article/us/en/19/how10169/configuring-windows-server-2012-r2-as-a-router?lang=en

After setting that up, traffic to 10.1.2.1 is indeed being NAT'd and sent on to 192.168.1.1, and my VM can see the traffic. Great! The problem is that traffic from 10.1.3.1 isn't being sent to 192.168.1.1.

I was expecting something in Windows where you can say: "Anything coming in on IP x.x.x.x, use NAT and send on to y.y.y.y. Anything coming out of y.y.y.y, use SNAT and send on to x.x.x.x".

I've read the technet article on using netsh to configure routing and manage nat (https://technet.microsoft.com/en-us/library/cc754535(v=ws.10).aspx) - but so far I haven't found a way to add a single external IP to the pool.

I feel as though this should be a simple task, but I haven't been able to get it set up. I'd like to add additional external IP address to the host, and NAT them on to the Hyper-V switch, but I'm stuck!

How can I get the host configured to perform NAT on selected external IPs?

EDIT: Appleoddity's answer raised an issue I forgot to bring up - this machine is in a datacenter that I don't have access to, and the provider can't add additional NICs. I also cannot make the Hyper-V switch external, as when I tried this the host was booted from the network. After a call to the provider, I learned that they don't allow this behavior.

0

I'm going to go out on a limb here and say you are over thinking this. If your intention is to connect your physical host and 2 virtual guests each to 1 of 3 public IPs that are available on a single physical interface, then you do not need NAT.

Simply create a standard Hyper-V switch that has "External" access to the physical network adapter.

This will create an "External" interface on the physical host, and you can add a network adapter to each virtual host that is connected to that "External" switch.

Now, assign Public IP 1 to the "External" interface on the physical host. Assign Public IP 2 to Virtual machine #1's interface, and Public IP 3 to Virtual machine #2's interface.

In essence all machines are bridged, but because they are using different public IPs they'll only respond to those IPs. To picture it a different way, picture it as 3 separate physical machines plugged in to your ISPs modem/router - each machine is plugged in to the same network switch - but each has a different public IP assigned to it's interface.

When you purchase public IPs they usually come in blocks. And because you used "private" IPs in your example above, rather than provide the true public IPs and subnet mask, I can't say rather each IP is on the same subnet - but this is usually the case. If this is the case, then this is the typical way you always use your block of public IPs because they are all on the same "network" anyways.

In addition, if you continue down the road of NAT then you have to start doing port forwarding also. If no NAT, obviously, there should be a firewall (either software or hardware based) between the machine and the internet.

  • Thanks for the comment. I should clarify that this machine is in a datacenter that I don't have physical access to, and the provider can't add additional NICs to the box. We also can't create an external Hyper-V switch, as the provider provider doesn't allow this (I tried and the machine was booted from the network - after a call to the provider they let me know they don't allow this) I don't mind the port forwarding piece, I'd just like to be able to assign some of the external IP addresses on the host to 1/many VMs running on the same machine. – Alec Sep 12 '17 at 21:44
  • Ok. I understand, but it doesn't sound right. Is the physical host yours? (the server is co-located) If the Data Center is providing multiple static IPs then they should also allow multiple MAC addresses hooked up to the physical cable to use them. Sorry it's not working out that way. Just wanted you to be aware of how we would usually do this. If I were you, I might push this issue a bit just to make sure everybody is on the same understanding. – Appleoddity Sep 12 '17 at 21:57
  • Thanks for the comment Appleoddity. The physical host is not mine - we're paying a monthly fee for the rental. I like your idea of pushing the additional MAC address - that setup seems like it would be much more straight forward. I'm going to reach out to them – Alec Sep 12 '17 at 22:09

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.