0

I know that this question might have already been asked, but I'm struggling with doing it the way that I want it to be. Ok, so here's the situation:

2 VM's

VM A - CentOS (with two network adapters):

External NIC - Bridged with the host machine (we will call this one for simplicity "External A". DHCP enabled

Internal NIC - "Internal A". Static IP, DHCPD server configured to listen only on that interface

VM B -Debian (only one network adapter)

Internal NIC - "Internal B", in one network with "Internal A", DHCP enabled, successfully receives IP from Internal A.

Ok, so here what I want to to. Because I don't want to give NAT access to the Internal NICs, is there a way I can route all of the EXTERNAL traffic to go through External A NIC on VM 1?

NOTE:

External A and Internal a are in totally different subnets.

External A - 192.168.0.X

Internal A - 192.168.135.X

2 Answers 2

1

check if "internal A" has a default gateway and the same for "internal b"

Delete all iptables rules of the nat table if you can with:

iptables --flush -t nat

VM01

[root@centos01 ~]# route -n | grep enp0s3
0.0.0.0         192.168.0.1     0.0.0.0         UG    100    0        0 enp0s3
192.168.0.0     0.0.0.0         255.255.255.0   U     100    0        0 enp0s3

VM01 Network config:

enp0s3: conectado to enp0s3
        inet4 192.168.0.41/24
        route4 0.0.0.0/0
        route4 192.168.0.0/24

enp0s8: conectado to enp0s8
        inet4 192.168.135.254/24
        route4 192.168.135.0/24
        route4 192.168.0.1/32
        route4 0.0.0.0/0

VM02

[root@centos02 ~]# route -n | grep enp0s3
0.0.0.0         192.168.135.254 0.0.0.0         UG    100    0        0 enp0s3
192.168.135.0   0.0.0.0         255.255.255.0   U     100    0        0 enp0s3

VM02 Network config:

enp0s3: conectado to enp0s3
    inet4 192.168.135.50/24
    route4 0.0.0.0/0
    route4 192.168.135.0/24

VM01 forward check:

[root@centos01 ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

VM01 iptables, lets insert the rule instead of append it:

iptables -t nat -I PREROUTING --src 192.168.135.0/24 --dst 0/0 -j ACCEPT
iptables -t nat -I POSTROUTING -j MASQUERADE

VM01 iptables check:

[root@centos01 ~]#  iptables -nL -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  192.168.135.0/24     0.0.0.0/0

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0

let me know if it worked :)

1
  • Ah great, that seems to have done the job. I've successfully pinged the External A adapter from VM 2 and it works brilliantly :) Probably because of all the rules i've inserted in iptables, might have messed up something. Edit: tried pinging some websites, works as well. Thank you very much once again :)
    – joniop
    May 31, 2020 at 15:44
1

I think this should work. Run this on VM A

Enable ip forward (permanent)

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

Accept the traffic comming from 192.168.135.x

iptables -t nat -A PREROUTING --src 192.168.135.0/24 --dst 0/0 -j ACCEPT

NAT the traffic

iptables -t nat -A POSTROUTING -j MASQUERADE
1
  • Hmm looks like it doesn't work. Any additional setups I need to do?
    – joniop
    May 31, 2020 at 9:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .