We have recently bought a server from the Hetzner server auction and want to migrate our previous root server.
Previously we used only windows server, but now we want to set it up a bit more modular with proxmox.
We have a single public IP address, so we chose to use NAT with a 10.0.0.0/24 internal subnet.
The containers can access the internet, so this works fine.
But we can't connect to servers which run inside the containers over custom ports.
How can I properly forward the ports? We tried the routing and port forwarding as listed below. Something went wrong, the ports arent open, as shown by portscans.
There is currently only a firewall in the Proxmox host, the server host firewall is disabled, so I dont know why traffic should be blocked.
This is the current setup of the proxmox network interface:
auto lo
iface lo inet loopback
iface lo inet6 loopback
auto eno1
iface eno1 inet static
address public.ipv4/26
gateway public.gateway
up route add -net public.ipv4 netmask 255.255.255.192 gw public.ipv4 dev eno1
# route public.ipv4.range.start/26 via public.ipv4.range.start+1
iface eno1 inet6 static
address public.ipv6/128
gateway fe80::1
auto vmbr0
iface vmbr0 inet static
address 10.0.0.1/24
bridge-ports none
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up echo 1 > /proc/sys/net/ipv4/conf/eno1/proxy_arp
post-up iptables -t nat -A POSTROUTING -s '10.0.0.0/24' -o eno1 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/24' -o eno1 -j MASQUERADE
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 28967 -j DNAT --to 10.0.0.4:28967
post-up iptables -t nat -A PREROUTING -i vmbr0 -p udp --dport 28967 -j DNAT --to 10.0.0.4:28967
post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 28967 -j DNAT --to 10.0.0.4:28967
post-down iptables -t nat -D PREROUTING -i vmbr0 -p udp --dport 28967 -j DNAT --to 10.0.0.4:28967
iface vmbr0 inet6 static
address public.ipv6+1/64
iptables -L -t nat:
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere anywhere tcp dpt:28967 to:10.0.0.4:28967
DNAT udp -- anywhere anywhere udp dpt:28967 to:10.0.0.4:28967
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.0.0.0/24 anywhere
The eno1 interface was autogenerated by their installation script.
We added the bridge and the NAT etc.
Client config:
auto lo
iface lo inet loopback
iface lo inet6 loopback
auto eth0
iface eth0 inet static
address 10.0.0.4/24
gateway 10.0.0.1
pointtopoint public.ipv4
Client container has currently no firewall.
We are relatively inexperienced with networking inside a KWM host, so any help is greatly appreciated!
