I have a server with a proxmox installation and only 1 outbound connection (eth0).
To make the machines network between each other I created a network bridge (vmbr0) in the interfaces configuration and configured it accordingly to the Proxmox Network Model (Subpoint NAT).
The bridge has the IP
10.1.1.1 and acts in my understanding as a getway between the local network and the wide world.
To achieve this, following iptable policies are implemented on the server:
Chain FORWARD (policy DROP) target prot opt source destination ACCEPT all -- 10.1.1.0/24 anywhere ACCEPT all -- anywhere 10.1.1.0/24 Chain POSTROUTING (policy ACCEPT) target prot opt source destination SNAT all -- 10.1.1.0/24 anywhere to:x.x.x.x
When I ping the Google DNS server from one of the vms installed on the server and connected via the bridge using:
ping 22.214.171.124, the vm is able to get a ping result from the Google DNS server so the NAT seems to be working.
(The nat is again for the whole Subnet (10.1.1.0/24) )
If I do:
ping -I vmbr0 126.96.36.199 on the host machine however, the ping command fails. This ping commands uses the bridge interface to ping the Google DNS server and my expectation was, that the POSTROUTING policies would make it able to communicate with the Google DNS server too.
So in short, when other clients using the bridge as gateway they can connect to the internet, but if the interface itself is selected as outgoing interface it can't find a route.
So this leads me to my question, is explicitly using an interface somehow skipping postrouting rules and is really taken as the absolute endpoint for routing on the concerning machine?
- in a sense: vmbr0 stays vmbr0 and never will be masqueraded to eth0 if you choose to ping over it -