4

I have an host with proxmox with single public ip and some virtual machine installed whit webservers and multiple doimains, the first VM is a proxy with haproxy that forward the request to other VM and in proxmox host i have this iptables script:

iptables -F
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 22100 -j DNAT --to-destination 192.168.1.100:22
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.100:443
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 22101 -j DNAT --to-destination 192.168.1.101:22
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 22102 -j DNAT --to-destination 192.168.1.102:22
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 22103 -j DNAT --to-destination 192.168.1.103:22
iptables-save > /etc/iptables.rules

Internal lan is 192.168.1.0, the interface eth0 has public ip, the proxy is 192.168.1.100 and the other machine is 101, 102, 103 etc..

In another VM i have installed a website that works if i connect from external, instead if i launch curl www.mydomain.com from the same VM i have curl: (7) Failed connect to www.mydomain.com:80; Connection refused, i think it is a problem of iptables

  • So the problem is when you want to connect from one of these VM to another one, which is not in that LAN ? – Corentin Peuvrel Mar 2 '15 at 11:41
  • The problem occurs on all virtual machines that belong to the same LAN (192.168.1.x). But I'm interested in doing a " curl" from the same machine – hellb0y77 Mar 2 '15 at 12:15
  • I don't understand, you want to access the port 80 of one of the VM (192.168.1.0/24) from another VM (192.168.1.0/24) ? Can you ping the other VM ? – Corentin Peuvrel Mar 2 '15 at 13:04
  • So, i need connect to www.mydomain.com:80, not 192.168.1.101:80, my.domain.com is registered as DNS and works, if i ping www.mydomain.com, DNS resolve address and ping, if i make a curl www.mydomain.com, i have curl: (7) Failed connect to www.mydomain.com:80 Connection refused. The IP of www.mydomain.com is a public ip of machine with proxmox, there is a iptables rule that forward the request on port 80 to proxy with haproxy, haproxy is config to forward according to hostname. From external works perfectly, from all internal VM no. – hellb0y77 Mar 2 '15 at 13:50
  • Could you try, on the proxy : tcpdump -i eth0 host www.mydomain.com, and then the curl on your VM. It will show on which step the stream is stopped : If there is no packets at all it's between the VM and the proxy, if there is just the VM output packet, the problem should be with masquerading (I guess...), etc... If there are too much result, add and host 192.168.1.101 (assuming you use the VM x.101 to curl) – Corentin Peuvrel Mar 2 '15 at 14:20
1

Finally found a solution or work-around. I don't know whats causing this (It has to do with som Proxmox or Debian frewall or something), my old setup with plain OpenVZ worked fine.

The problem is when using services on VM A from another VM B on the same server (same external IP). If I used a proxy on another server, all went well, because the IP of the other proxy is different from the one of the server.

So just don't let the call to the service go outside the server. I setup a DNS service on the server with dsnmasq. The call from VM B now hits the DNS on the server and gets the IP of VM A. Don't forget to set the nameserver for each VM to the local server!

This solution has the added benefit that some speed is gained by caching all DNS calls from the VMs on the server.


Detailed instructions:

Install dnsmasq on the server

# apt-get install dnsmasq
# update-rc.d dnsmasq enable

configure dnsmasq to act as a DNS server and cache:

# cp /etc/dnsmasq.conf /etc/dnsmasq.conf.orig
# vi /etc/dnsmasq.conf

uncomment the following lines:

domain-needed
bogus-priv

Tell it to listen to the internal IP of the server itself:

listen-address=10.0.186.254   # internal IP
listen-address=127.0.0.1      # must be added too

add localhost as a nameserver :

# vi /etc/resolv.conf

search mydomain.com
nameserver 127.0.0.1    # this line added
nameserver 8.8.8.8

add entries for domains that should be routed to your local proxy (10.0.186.1) or VM:

# vi /etc/hosts

10.0.186.1 api.mydomain.com           # these all point to the proxy 
10.0.186.1 loginservice.mydomain.com
10.0.186.1 api.otherdomain.com

Don't forget to restart dnsmasq after changing /etc/hosts

# service dnsmasq restart

Make sure to add 127.0.0.1 as (primary) nameserver to all VMs in Proxmox web interface!

0

I had the very same problem with a Proxmox server hosting a few containers. One of these was a Gitlab server.

From one of the containers or even from the host, I couldn't clone any of the repos.

The solution was dead simple though: open /etc/hosts and redirect all of your domains/subdomains to your proxy:

192.168.0.100 mydomain.com www.mydomain.com subdomain.mydomain.com

Works like a charm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.