I have 2 VM's running CentOS 7 with the following ifconfig
configurations:
VM1: ifconfig
eth0: public ip
eth0:0: LAN IP 172.22.xx.x1
VM2: ifconfig
eth0: no public ip
eth0:0: LAN IP 172.22.xx.x2
And I want VM2
to be able to access the internet. Any ideas on how to achieve this?
I've tried every combination of iptables
POSTROUTING, PREROUTING, FORWARD, DNAT, SNET
and route
you can think of to no avail. I must be doing something wrong.
Does anyone have a simple example of how to achieve this?
To test VM2
external access, I am pinging www.google.com
(and IP) -- but getting unknown host and 100% packet loss respectively.
EDIT - More info
Running tcpdump -nni eth0:0 icmp
on VM1
and ping 8.8.8.8
on VM2
yields the following results:
09:28:05.957841 IP VM2 private ip > 8.8.8.8: ICMP echo request, id 13950, seq 6, length 64
09:28:05.957900 IP VM1 public ip > 8.8.8.8: ICMP echo request, id 13950, seq 6, length 64
09:28:05.959157 IP 8.8.8.8 > VM1 public ip: ICMP echo reply, id 13950, seq 6, length 64
09:28:05.959172 IP 8.8.8.8 > VM2 private ip: ICMP echo reply, id 13950, seq 6, length 64
But VM2
doesn't receive the packets. Here is my iptables
script for VM1
:
echo 1 > /proc/sys/net/ipv4/ip_forward
# Flush tables
iptables -F
iptables -t nat -F
iptables -A FORWARD -i eth0:0 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
service iptables restart
And route
for VM2
:
route add default gw <VM1 private ip>
EDIT 2 - More info
VM2 route
:
[travis@VM2 ~]$ sudo route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 172.22.20.195 0.0.0.0 UG 0 0 0 eth0
172.22.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
And VM1 iptables
:
[travis@VM1 ~]$ sudo iptables -vnL
Chain INPUT (policy ACCEPT 3039 packets, 651K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 88 packets, 6598 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- eth0:0 eth0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 2602 packets, 304K bytes)
pkts bytes target prot opt in out source destination
[travis@VM1 ~]$ sudo iptables -t nat -vnL
Chain PREROUTING (policy ACCEPT 114 packets, 9000 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 81 packets, 6692 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 167 packets, 10845 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
200 13153 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0
172.22.xx.xx
and can ping each other.route add default gw host
.tcpdump -nni eth0:0 icmp
onVM Host
andping host
(host is hostname) onVM client
shows successful pings intcpdump
. Doing aping google.com
fromVM client
yields nothing and aping 8.8.8.8
shows up inVM Host tcpdump
, but 100% packet loss onVM Client
. Does this indicate that theicmp
replies are not being forwarded back toVM Client
? I haveip_forward
set to1
. See OP for more details..