Member Avatar for James_43

Hi all, I'm having a lot of trouble with building a network for my virtualised OS's.

The server has two physical NICs for LAN and WAN. The host has IP 10.0.0.1. I use the following iptables to bridge them.

iptables -t nat -A POSTROUTING -o wan -j MASQUERADE
iptables -A FORWARD -i wan -o lan -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i lan -o wan -j ACCEPT

I now also have a virtualised Windows Server. I have told the virtual server to use the virbr01 network adapter, which I define in /etc/network/interfaces as below:

# Virtual bridge dummy
auto virbr01-dummy
iface virbr01-dummy inet manual
        pre-up /sbin/ip link add virbr01-dummy type dummy
        up /sbin/ip link set virbr01-dummy address 52:54:00:77:a4:d6

# Virtual bridge
auto virbr01
iface virbr01 inet static
        bridge_ports virbr01-dummy
        bridge_stp on
        bridge_fd 2
        address 10.0.1.1
        netmask 255.255.255.0

From the linux host, I can ping 10.0.1.1 successfully, and for the meantime I've set the Windows guest to have a static ip of 10.0.1.2 and a default gateway of 10.0.1.1 (until I move to DHCP).

I'm now having issues connecting to the guest from the host, or the wider LAN network. The iptables I have used are below:

-A FORWARD -d 10.0.0.0/24 -o virbr01 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.0.0.0/24 -i virbr01 -j ACCEPT
-A FORWARD -i virbr01 -o virbr01 -j ACCEPT
-A POSTROUTING -s 10.0.1.0/24 ! -d 10.0.1.0/24 -j MASQUERADE

As far as I can see, this should forward my requests from the LAN DHCP range, to the virbr01 adapter. But it doesn't. Are my iptables bridging the LAN and WAN ports getting in the way?

Thanks!

Edited by James_43
  • 2 Contributors
  • 2 Replies
  • 426 Views
  • 17 Hours Discussion Span
  • Latest Post Latest Post by James_43

Dani AI

Generated

Brief diagnosis and practical checklist

As observed, the environment uses two separate subnets (physical and virtual). Outbound NAT (MASQUERADE) lets guests reach other networks but does not automatically create a route back from the LAN to the 10.0.1.0 network, so machines on the LAN won’t initiate connections to the guest unless one of three approaches is used: add a route on the LAN gateway, use DNAT/port‑forwarding on the host, or place the VM on the same L2 network as the LAN.

Quick verification steps (run on the host)

cat /proc/sys/net/ipv4/ip_forward
modprobe br_netfilter
sysctl net.bridge.bridge-nf-call-iptables
iptables -nvL FORWARD
iptables -t nat -nvL
ip route show
bridge link show    # or brctl show on older systems
tcpdump -n -i eth0 host 10.0.1.2

Three practical fixes (tradeoffs)

  • Route on LAN gateway: add a static route for the VM subnet via the host’s LAN IP. This is clean and preserves end‑to‑end addressing, but requires access to the LAN router.
  • DNAT / port‑forward: translate selected inbound ports on the host to the guest (PREROUTING + FORWARD rules). No router change required, but per‑service forwarding is needed.
  • Bridge to LAN (L2): attach the VM bridge to the physical NIC so the VM becomes a LAN host. Simple from a reachability perspective, but changes topology and may expose the VM directly to the LAN.

Additional notes

Confirm the Windows guest firewall is not blocking the test traffic. Check the host FORWARD chain policy and conntrack state handling (bridge traffic hits iptables only when br_netfilter is enabled). Use tcpdump on the host’s LAN interface to see whether LAN packets reach the host; absence of packets indicates a routing/gateway issue rather than an iptables problem.

Recommended Answers

All 2 Replies

Member Avatar for rubberman

It looks like you have two subnets, 10.0.0.0 and 10.0.1.0. Is this correct?

Member Avatar for James_43

Correct :) 10.0.0.0 for physical LAN, and ideally 10.0.1.0 for virtual LAN.

Though I also have a different subnet on my WAN adapter, 192.168.209.0. At the moment the Lan and Wan are passing packets through iptables.

Edited by James_43
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.