0

I am running Proxmox VE on a root server. There are several virtual containers, on of them acts as a reverse proxy who does TLS termination.

On the proxmox machine iptables handles port forwarding and protection of the internal network. The configuration looks like this:

*nat
# enable network access for vms
-A POSTROUTING -s 192.168.1.0/24 -o enp4s0 -j MASQUERADE
# reverseproxy
-A POSTROUTING -s 192.168.1.2/24 -o vmbr0 -j MASQUERADE
-A PREROUTING -i vmbr0 -p tcp --dport 80 -j DNAT --to 192.168.1.2:80
-A PREROUTING -i vmbr0 -p tcp --dport 443 -j DNAT --to 192.168.1.2:443
COMMIT

*filter
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
# Accepts established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allows all outbound traffic
-A OUTPUT -j ACCEPT
# Allows SSH connection
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
# Allow ping
-A INPUT -p icmp -j ACCEPT
# log iptables denied calls (access via 'dmesg' command)
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
# Reject all other inbound - default deny unless explicitly allowed policy:
-A INPUT -j REJECT
COMMIT

When i try to connect (with wget) from one container to the public url of another container, i get an error message containing: "xxx.xxx.xxx.xxx|:443... failed: Connection refused."

When i access the same url from the outside i can access the container without problems. Is there something i accidentially blocked or forgot to enable?

user393856
  • 185
  • 3
  • 15

1 Answers1

0

The answer was quite obvious:

i enabled port forwarding for the reverse proxy coming from the interface vmbr0 (bridge between static server ip and internal network) but not for vmbr1 (bridge over which containers are connected). As domain names resolved to the external IP, but the packets were coming from the internal bridge vmbr1 and not from the external vmbr0 no port forwarding was done.

The solution was adding this in the *nat table:

-A POSTROUTING -s 192.168.1.2/24 -o vmbr1 -j MASQUERADE
-A PREROUTING -i vmbr1 -d SERVERIP -p tcp --dport 80 -j DNAT --to 192.168.1.2:80
-A PREROUTING -i vmbr1 -d SERVERIP -p tcp --dport 443 -j DNAT --to 192.168.1.2:443
user393856
  • 185
  • 3
  • 15