I have an host with proxmox with single public ip and some virtual machine installed whit webservers and multiple doimains, the first VM is a proxy with haproxy that forward the request to other VM and in proxmox host i have this iptables script:

iptables -F
iptables -P INPUT ACCEPT

iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 22100 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 22101 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 22102 -j DNAT --to-destination
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 22103 -j DNAT --to-destination
iptables-save > /etc/iptables.rules

Internal lan is, the interface eth0 has public ip, the proxy is and the other machine is 101, 102, 103 etc..

In another VM i have installed a website that works if i connect from external, instead if i launch curl www.mydomain.com from the same VM i have curl: (7) Failed connect to www.mydomain.com:80; Connection refused, i think it is a problem of iptables

  • So the problem is when you want to connect from one of these VM to another one, which is not in that LAN ? Mar 2, 2015 at 11:41
  • The problem occurs on all virtual machines that belong to the same LAN (192.168.1.x). But I'm interested in doing a " curl" from the same machine
    – stecog
    Mar 2, 2015 at 12:15
  • I don't understand, you want to access the port 80 of one of the VM ( from another VM ( ? Can you ping the other VM ? Mar 2, 2015 at 13:04
  • So, i need connect to www.mydomain.com:80, not, my.domain.com is registered as DNS and works, if i ping www.mydomain.com, DNS resolve address and ping, if i make a curl www.mydomain.com, i have curl: (7) Failed connect to www.mydomain.com:80 Connection refused. The IP of www.mydomain.com is a public ip of machine with proxmox, there is a iptables rule that forward the request on port 80 to proxy with haproxy, haproxy is config to forward according to hostname. From external works perfectly, from all internal VM no.
    – stecog
    Mar 2, 2015 at 13:50
  • Could you try, on the proxy : tcpdump -i eth0 host www.mydomain.com, and then the curl on your VM. It will show on which step the stream is stopped : If there is no packets at all it's between the VM and the proxy, if there is just the VM output packet, the problem should be with masquerading (I guess...), etc... If there are too much result, add and host (assuming you use the VM x.101 to curl) Mar 2, 2015 at 14:20

2 Answers 2


Finally found a solution or work-around. I don't know whats causing this (It has to do with som Proxmox or Debian frewall or something), my old setup with plain OpenVZ worked fine.

The problem is when using services on VM A from another VM B on the same server (same external IP). If I used a proxy on another server, all went well, because the IP of the other proxy is different from the one of the server.

So just don't let the call to the service go outside the server. I setup a DNS service on the server with dsnmasq. The call from VM B now hits the DNS on the server and gets the IP of VM A. Don't forget to set the nameserver for each VM to the local server!

This solution has the added benefit that some speed is gained by caching all DNS calls from the VMs on the server.

Detailed instructions:

Install dnsmasq on the server

# apt-get install dnsmasq
# update-rc.d dnsmasq enable

configure dnsmasq to act as a DNS server and cache:

# cp /etc/dnsmasq.conf /etc/dnsmasq.conf.orig
# vi /etc/dnsmasq.conf

uncomment the following lines:


Tell it to listen to the internal IP of the server itself:

listen-address=   # internal IP
listen-address=      # must be added too

add localhost as a nameserver :

# vi /etc/resolv.conf

search mydomain.com
nameserver    # this line added

add entries for domains that should be routed to your local proxy ( or VM:

# vi /etc/hosts api.mydomain.com           # these all point to the proxy loginservice.mydomain.com api.otherdomain.com

Don't forget to restart dnsmasq after changing /etc/hosts

# service dnsmasq restart

Make sure to add as (primary) nameserver to all VMs in Proxmox web interface!


I had the very same problem with a Proxmox server hosting a few containers. One of these was a Gitlab server.

From one of the containers or even from the host, I couldn't clone any of the repos.

The solution was dead simple though: open /etc/hosts and redirect all of your domains/subdomains to your proxy: mydomain.com www.mydomain.com subdomain.mydomain.com

Works like a charm.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .