CentOS Hyper V Guest VM Not accessible from the Internet

Question

I have a CentOS VM sitting on HyperV host with two interfaces, One interface connected to the domain Network via a switch (192.168.1.8 /24) GW 192.168.1.254. Another interface is connected directly to the firewall (fortigate) (172.20.0.1/29) GW 172.20.0.254.The above interfaces are also setup as Hyper-V Virtual switches on the Host.

The Gateways are interfaces setup on the FW setup to segregate traffic.

172.20.0.x /29 is public address segment assigned by the ISP.

The guest VM has two interfaces eth0 (192.168.1.7/24) connected via 192.168.1.8 (Virtual Switch) on host. And eth1(172.168.0.2/29) connected via 172.20.0.1 (Virtual Switch) on host.

Problem is I can ping both interfaces on the VM from the Host and from the Firewall. But I can not ping eth1(172.20.0.2) from the internet, but able to reach host interface 172.20.0.1 from the internet.

Please note that CentOS Guest VM can ping Local Area Networks resources and reach internet with source ping from both interfaces.

When I trace route to both addresses 172.20.0.1 and 172.20.0.2 from an external source IP on AWS. I can reach 172.20.0.1 (Host Interface). Route to 172.20.0.2 (VM Interface) terminates just before the firewall from outside.

My train of thought is now leading me to think that there is additional configuration that needs to be done on the FW, maybe add a static route on the FW relaying traffic directly to the VM? Any thoughts? I just want to be sure before I commence with this exercise.

Answer 1

This is a highly unusual configuration, and you have some errors and/or typos.

The normal way to do this would be to setup the Hyper-V switches as an external switches. Doing so allows the VM virtual NICs to talk directly to the other network hardware. E.g. 192.168.1.7 would talk to 192.168.1.254. There is no need for the host to have a network adapter or IP address at all with 192.168.1.8. Similar for the 172.20.0.0 subnet. I'm suspicious that you may have an internal virtual switch setup as a NAT with bad subnetting.

You mention 172.168.0.2/29 which I assume is a typo of 172.20.0.2/29. However 172.20.0.2/29 only covers addresses 172.20.0.0-172.20.0.7 while you specify the gateway as 172.20.0.254. Since the gateway is not in the subnet this interface cannot route to it. This makes me think that the 172.20.0.1 that you are reaching is not your host, but is in fact a different interface on the firewall or router.

You mention 172.20.0.0/29 is assigned by the ISP, but you've labeled a router out front, and a firewall behind it, and the VM with the same subnet. The router and firewall should each normally have a different subnet on the inside than outside. It appears you are trying to use the same subnet between the hosts and the firewall that is also used between the firewall and router. While there are such firewalls that act as transparent bridges, it is far more common to have routed segments.

Overall I wonder what you are trying to do. Multi-homing with multiple adapters on different subnets is a relatively rare occurrence, and putting a machine on both the external Internet behind a firewall (let's call it a DMZ) and the internal LAN is a very poor security practice. It's much simpler to do this with one adapter and a DMZ, or one adapter and a NAT, then let the firewall or router route between the DMZ and LAN subnets.

Answer 2

You can't have two default gateways on a single machine, the other one becomes redundant. you can segregate the traffic and route directly from host interface to internet.