IPTables NAT and virtual interfaces

Question

I have 2 VM's running CentOS 7 with the following ifconfig configurations:

VM1: ifconfig
eth0: public ip
eth0:0: LAN IP 172.22.xx.x1

VM2: ifconfig
eth0: no public ip
eth0:0: LAN IP 172.22.xx.x2

And I want VM2 to be able to access the internet. Any ideas on how to achieve this?

I've tried every combination of iptables POSTROUTING, PREROUTING, FORWARD, DNAT, SNET and route you can think of to no avail. I must be doing something wrong.

Does anyone have a simple example of how to achieve this?

To test VM2 external access, I am pinging www.google.com (and IP) -- but getting unknown host and 100% packet loss respectively.

EDIT - More info

Running tcpdump -nni eth0:0 icmp on VM1 and ping 8.8.8.8 on VM2 yields the following results:

09:28:05.957841 IP VM2 private ip > 8.8.8.8: ICMP echo request, id 13950, seq 6, length 64
09:28:05.957900 IP VM1 public ip > 8.8.8.8: ICMP echo request, id 13950, seq 6, length 64
09:28:05.959157 IP 8.8.8.8 > VM1 public ip: ICMP echo reply, id 13950, seq 6, length 64
09:28:05.959172 IP 8.8.8.8 > VM2 private ip: ICMP echo reply, id 13950, seq 6, length 64

But VM2 doesn't receive the packets. Here is my iptables script for VM1:

echo 1 > /proc/sys/net/ipv4/ip_forward

# Flush tables
iptables -F
iptables -t nat -F

iptables -A FORWARD -i eth0:0 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables-save > /etc/sysconfig/iptables
service iptables restart

And route for VM2:

route add default gw <VM1 private ip>

EDIT 2 - More info

VM2 route:

[travis@VM2 ~]$ sudo route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.22.20.195   0.0.0.0         UG    0      0        0 eth0
172.22.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth0

And VM1 iptables:

[travis@VM1 ~]$ sudo iptables -vnL
Chain INPUT (policy ACCEPT 3039 packets, 651K bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain FORWARD (policy ACCEPT 88 packets, 6598 bytes)
 pkts bytes target     prot opt in     out     source               destination        
    0     0 ACCEPT     all  --  eth0:0 eth0    0.0.0.0/0            0.0.0.0/0          

Chain OUTPUT (policy ACCEPT 2602 packets, 304K bytes)
 pkts bytes target     prot opt in     out     source               destination        

[travis@VM1 ~]$ sudo iptables -t nat -vnL
Chain PREROUTING (policy ACCEPT 114 packets, 9000 bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain INPUT (policy ACCEPT 81 packets, 6692 bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain OUTPUT (policy ACCEPT 167 packets, 10845 bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        
  200 13153 MASQUERADE  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0