0

I have a server with a proxmox installation and only 1 outbound connection (eth0).

To make the machines network between each other I created a network bridge (vmbr0) in the interfaces configuration and configured it accordingly to the Proxmox Network Model (Subpoint NAT).

The bridge has the IP 10.1.1.1 and acts in my understanding as a getway between the local network and the wide world.

To achieve this, following iptable policies are implemented on the server:

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  10.1.1.0/24          anywhere
ACCEPT     all  --  anywhere             10.1.1.0/24

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  10.1.1.0/24          anywhere             to:x.x.x.x

When I ping the Google DNS server from one of the vms installed on the server and connected via the bridge using: ping 8.8.8.8, the vm is able to get a ping result from the Google DNS server so the NAT seems to be working.

(The nat is again for the whole Subnet (10.1.1.0/24) )

If I do: ping -I vmbr0 8.8.8.8 on the host machine however, the ping command fails. This ping commands uses the bridge interface to ping the Google DNS server and my expectation was, that the POSTROUTING policies would make it able to communicate with the Google DNS server too.

So in short, when other clients using the bridge as gateway they can connect to the internet, but if the interface itself is selected as outgoing interface it can't find a route.

So this leads me to my question, is explicitly using an interface somehow skipping postrouting rules and is really taken as the absolute endpoint for routing on the concerning machine? - in a sense: vmbr0 stays vmbr0 and never will be masqueraded to eth0 if you choose to ping over it -

  • I read this three times, and I'm still not sure what is exactly that you're doing. Can you edit your question to clarify it? What host are those iptables rules on? What host are you running the ping on? What command are you using to run the ping? (you showed the second one, but not the first one) – ilkkachu Aug 24 '18 at 17:37
  • sorry for the wasted time :D the iptable rules are implemented on the host, the host is a server, dedicated to be exact - and I edited a bit, I hope it is clearer now. Sometimes I have a hard time to express myself in english – mayen Aug 24 '18 at 17:57
1

man ping, bolds mine:

-I interface
interface is either an address, or an interface name. If interface is an address, it sets source address to specified interface address. If interface in an interface name, it sets source interface to specified interface.

The issue is with forcing the interface with ping -I vmbr0 instead of letting the system choose in the end the right interface with ping -I 10.1.1.1.

Also, even if this doesn't make a difference with nat/POSTROUTING (see later), you should understand that you're not routing when running a command on the host, so some chains (eg: filter/FORWARD) might not apply (but nat/POSTROUTING still does, see later). Keep in mind that this might give different results when running commands on the host instead of a routed VM depending on your rules, even if that's not the case here with the right ping command.

this Packet Flow in Netfilter and General Networking schematic shows that after the different OUTPUT chains are traversed for a packet coming from a local process, nat/POSTROUTING still gets traversed after, so yes had your packet be going outside through eth0 it would still have been SNATed: that's by using ping -I 10.1.1.1 8.8.8.8

Instead when forcing the interface with ping -I vmbr0 8.8.8.8, if you run tcpdump on vmbr0 you'll likely see ARP requests from 10.1.1.1 to 8.8.8.8 which won't get answers.

And for the final question: yes forcing the route can't let the packet go to the right destination. You can't ever have vmbr0 be masqueraded, because SNAT/MASQUERADE is done on packets' IP, not on an interface, and its application depends on their route to the destination.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.