I have got this setup with two LANs and OpenVPN infra.
I need to share the OpenVPN connection attached to Proxmox server (10.8.0.12) to the Proxmox VMs (192.168.0,1,2,3,...).
I was trying to use linux bridge on Proxmox:
iface vmbr2 inet static
address 10.8.1.12/24
bridge-ports none
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.8.1.0/24' -o tun0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.8.1.0/24' -o tun0 -j MASQUERADE
together with manual static routes on VMs - but it didn't worked.
On the other hand, quite similar setup (using iptables NAT on vmbr1) for sharing the internet to the Proxmox VMs is working correctly.
Could You pls point me in the right direction? Has anybody tried to setup such a sharing?
Datails:
Proxmox server:
ip
lo UNKNOWN 127.0.0.1/8 ::1/128
eno1 UP
eno2 DOWN
tun0 UNKNOWN 10.8.0.12/24
vmbr0 UP pu.bl.ic.ip/31
vmbr1 UP 192.168.1.1/24 # the bridge for sharing internet ( it works )
vmbr2 UP 10.8.1.12/24 # I have made it in order to make a NAT
tap104i0 UNKNOWN
tap104i1 UNKNOWN
#
ip r
default via pu.bl.ic.ip dev vmbr0 proto kernel onlink
10.8.0.0/24 via 10.8.0.1 dev tun0 # OpenVPN route
10.8.1.0/24 dev vmbr2 proto kernel scope link src 10.8.1.12
192.168.1.0/24 dev vmbr1 proto kernel scope link src 192.168.1.1
#
iptables-save
*raw
:PREROUTING ACCEPT [555262:374327004]
:OUTPUT ACCEPT [453390:357667405]
COMMIT
*filter
:INPUT ACCEPT [3284:179456]
:FORWARD ACCEPT [1275:103329]
:OUTPUT ACCEPT [911:61638]
:PVEFW-Drop - [0:0]
:PVEFW-DropBroadcast - [0:0]
:PVEFW-FORWARD - [0:0]
:PVEFW-FWBR-IN - [0:0]
:PVEFW-FWBR-OUT - [0:0]
:PVEFW-HOST-IN - [0:0]
:PVEFW-HOST-OUT - [0:0]
:PVEFW-INPUT - [0:0]
:PVEFW-OUTPUT - [0:0]
:PVEFW-Reject - [0:0]
:PVEFW-SET-ACCEPT-MARK - [0:0]
:PVEFW-logflags - [0:0]
:PVEFW-reject - [0:0]
:PVEFW-smurflog - [0:0]
:PVEFW-smurfs - [0:0]
:PVEFW-tcpflags - [0:0]
-A INPUT -j PVEFW-INPUT
-A FORWARD -j PVEFW-FORWARD
-A OUTPUT -j PVEFW-OUTPUT
-A PVEFW-Drop -p tcp -m tcp
-A PVEFW-Drop -j PVEFW-DropBroadcast
-A PVEFW-Drop -p icmp -m icmp
-A PVEFW-Drop -p icmp -m icmp
-A PVEFW-Drop -m conntrack
-A PVEFW-Drop -p udp -m multiport
-A PVEFW-Drop -p udp -m udp
-A PVEFW-Drop -p udp -m udp
-A PVEFW-Drop -p tcp -m multiport
-A PVEFW-Drop -p udp -m udp
-A PVEFW-Drop -p tcp -m tcp !
-A PVEFW-Drop -p udp -m udp
-A PVEFW-Drop -m comment
-A PVEFW-DropBroadcast -m addrtype
-A PVEFW-DropBroadcast -m addrtype
-A PVEFW-DropBroadcast -m addrtype
-A PVEFW-DropBroadcast -d 224.0.0.0/4 -j DROP
-A PVEFW-DropBroadcast -m comment
-A PVEFW-FORWARD -m conntrack
-A PVEFW-FORWARD -m conntrack
-A PVEFW-FORWARD -m physdev
-A PVEFW-FORWARD -m physdev
-A PVEFW-FORWARD -m comment
-A PVEFW-FWBR-IN -m conntrack
-A PVEFW-FWBR-IN -m comment
-A PVEFW-FWBR-OUT -m comment
-A PVEFW-HOST-IN -i lo -j ACCEPT
-A PVEFW-HOST-IN -m conntrack
-A PVEFW-HOST-IN -m conntrack
-A PVEFW-HOST-IN -m conntrack
-A PVEFW-HOST-IN -p igmp -j RETURN
-A PVEFW-HOST-IN -i tun0 -p tcp -m tcp
-A PVEFW-HOST-IN -i tun0 -p tcp -m tcp
-A PVEFW-HOST-IN -p tcp -m set
-A PVEFW-HOST-IN -p tcp -m set
-A PVEFW-HOST-IN -p tcp -m set
-A PVEFW-HOST-IN -p tcp -m set
-A PVEFW-HOST-IN -p tcp -m set
-A PVEFW-HOST-IN -j PVEFW-Drop
-A PVEFW-HOST-IN -j DROP
-A PVEFW-HOST-IN -m comment
-A PVEFW-HOST-OUT -o lo -j ACCEPT
-A PVEFW-HOST-OUT -m conntrack
-A PVEFW-HOST-OUT -m conntrack
-A PVEFW-HOST-OUT -p igmp -j RETURN
-A PVEFW-HOST-OUT -d pu.bl.ic.ip/31 -p tcp -m tcp
-A PVEFW-HOST-OUT -d pu.bl.ic.ip/31 -p tcp -m tcp
-A PVEFW-HOST-OUT -d pu.bl.ic.ip/31 -p tcp -m tcp
-A PVEFW-HOST-OUT -d pu.bl.ic.ip/31 -p tcp -m tcp
-A PVEFW-HOST-OUT -j RETURN
-A PVEFW-HOST-OUT -m comment
-A PVEFW-INPUT -j PVEFW-HOST-IN
-A PVEFW-INPUT -m comment
-A PVEFW-OUTPUT -j PVEFW-HOST-OUT
-A PVEFW-OUTPUT -m comment
-A PVEFW-Reject -p tcp -m tcp
-A PVEFW-Reject -j PVEFW-DropBroadcast
-A PVEFW-Reject -p icmp -m icmp
-A PVEFW-Reject -p icmp -m icmp
-A PVEFW-Reject -m conntrack
-A PVEFW-Reject -p udp -m multiport
-A PVEFW-Reject -p udp -m udp
-A PVEFW-Reject -p udp -m udp
-A PVEFW-Reject -p tcp -m multiport
-A PVEFW-Reject -p udp -m udp
-A PVEFW-Reject -p tcp -m tcp !
-A PVEFW-Reject -p udp -m udp
-A PVEFW-Reject -m comment
-A PVEFW-SET-ACCEPT-MARK -j MARK
-A PVEFW-SET-ACCEPT-MARK -m comment
-A PVEFW-logflags -j DROP
-A PVEFW-logflags -m comment
-A PVEFW-reject -m addrtype
-A PVEFW-reject -s 224.0.0.0/4 -j DROP
-A PVEFW-reject -p icmp -j DROP
-A PVEFW-reject -p tcp -j REJECT
-A PVEFW-reject -p udp -j REJECT
-A PVEFW-reject -p icmp -j REJECT
-A PVEFW-reject -j REJECT
-A PVEFW-reject -m comment
-A PVEFW-smurflog -j DROP
-A PVEFW-smurflog -m comment
-A PVEFW-smurfs -s 0.0.0.0/32 -j RETURN
-A PVEFW-smurfs -m addrtype
-A PVEFW-smurfs -s 224.0.0.0/4 -g PVEFW-smurflog
-A PVEFW-smurfs -m comment
-A PVEFW-tcpflags -p tcp -m tcp
-A PVEFW-tcpflags -p tcp -m tcp
-A PVEFW-tcpflags -p tcp -m tcp
-A PVEFW-tcpflags -p tcp -m tcp
-A PVEFW-tcpflags -p tcp -m tcp
-A PVEFW-tcpflags -m comment
COMMIT
# Completed on Tue Oct 26 12:21:12 2021
# Generated by iptables-save v1.8.7 on Tue Oct 26 12:21:12
*nat
:PREROUTING ACCEPT [1409:85920]
:INPUT ACCEPT [984:53816]
:OUTPUT ACCEPT [459:29557]
:POSTROUTING ACCEPT [461:29725]
-A PREROUTING -d 10.8.0.12/32 -i vmbr2 -p tcp -j DNAT
-A PREROUTING -d 10.8.0.3/32 -i vmbr2 -p tcp -j DNAT
-A POSTROUTING -s 192.168.1.0/24 -o vmbr0 -j MASQUERADE
COMMIT
Completed on Tue Oct 26 12:21:12 2021
Proxmox VM:
ip
lo UNKNOWN 127.0.0.1/8
ens18 UP 192.168.1.104/24
ens19 UP 10.8.1.104/24
ip r
default via 192.168.1.1 dev ens18 proto static
10.8.1.0/24 dev ens19 proto kernel scope link src 10.8.1.104
192.168.1.0/24 dev ens18 proto kernel scope link src 192.168.1.104