Home / server / Questions / 441942
Accepted
blacksoul
Asked: 2012-10-25 10:39:18 +0800 CST

Access to WAN from one VLAN

  • 772

i want to create a VLAN for 3 guest VMs. I already have it and every VM can ping each other, but the problem is that any guest CAN NOT have access to Internet

Network configuration in Host machine

# /etc/network/interfaces
auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
    address 188.165.x.x            <------ Internet's public ip
    netmask 255.255.255.0
    network 188.165.255.0
    broadcast 188.165.255.255
    gateway 188.165.y.y            <------- Internet's public gateway
    bridge_ports eth0
    bridge_fd 0
    bridge_stp on

auto eth0.3
iface eth0.3 inet manual
        mtu 1500
        vlan_raw_device eth0

auto vlan3
iface vlan3 inet static
        bridge_ports eth0.3
        bridge_maxwait 0
        bridge_stp off
        address 172.69.0.1
        netmask 255.255.255.0
        network 172.69.0.0
        broadcast 172.69.0.255

Route list in Host machine route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.69.0.0      0.0.0.0         255.255.255.0   U     0      0        0 vlan3
188.165.255.0   0.0.0.0         255.255.255.0   U     0      0        0 br0
0.0.0.0         188.165.y.y 0.0.0.0         UG    0      0        0 br0

brctl showHost machine

bridge name bridge id       STP enabled interfaces
br0     8000.e840f20acc28   yes     eth0
                            tap10.0
                            vif10.0
                            vif7.0
vlan3   8000.e840f20acc28   no      eth0.3
                                    log01

Ping guest -> host working

PING 172.69.0.1 (172.69.0.1) 56(84) bytes of data.
64 bytes from 172.69.0.1: icmp_req=1 ttl=64 time=0.155 ms
64 bytes from 172.69.0.1: icmp_req=2 ttl=64 time=0.100 ms

Traceroute to, for example, Google's DNS ip

traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  172.69.0.1 (172.69.0.1)  0.198 ms  0.237 ms  0.209 ms
 2  * * *

As you can see, it dies in host ip (gateway).

I don't know what I am doing wrong

linux

1 Answers

  1. Best Answer

    You need to enable IP-forwarding by changing /proc/sys/net/ipv4/ip_forward to 1.

    You also need to apply an iptables-rule to NAT the VMs. (This should be applied on the host)

    iptables -t nat -A POSTROUTING -o <your external interface on the Host> -j MASQUERADE
    • 1