So I decided to play with EoIP Tunnels
today on two VMs which I installed free trial RouterOS
on them.
I set rules on iptables
on the hypervisor (which is Proxmox
) that prevents any input to vms except my pc, but my OUTPUT
policy is ACCEPT
.
Now I can't ping
vms from anywhere except my pc and I can't ping
my two vms (RouterOS
) from each other, but EoIP Tunnel
works fine and I'm routing packets from one RouterOS
to another one.
iptables
config on both vms:
IN ACCEPT -source a.b.c.d
IN DROP
(a.b.c.d is IP of my pc)
What I am doing wrong?
RouterOSs' config:
VM1:
/ip address
# ADDRESS NETWORK INTERFACE
0 r.o.s.1/32 m.a.i.n ether1
1 172.22.22.1/30 172.22.22.0 eoiptunnel
/ip route
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 172.22.22.2 1
1 ADC m.a.i.n/32 r.o.s.1 ether1 0
2 ADC 172.22.22.0/30 172.22.22.1 eoiptunnel 0
VM2:
/ip address
# ADDRESS NETWORK INTERFACE
0 r.o.s.2/32 m.a.i.n ether1
1 172.22.22.2/30 172.22.22.0 eoiptunnel
IPs:
r.o.s.1 : Router OS 1
r.o.s.2 : Router OS 2
m.a.i.n : Main Server IP
I monitor traffic on my host server by iptraf
and I watched two RouterOS
s are seeing each other via another interface, actually I realize that for every VM, proxmox
creates 4 interfaces, therefore I assume "some" packets between two VMs which are on the same bridge go through another interface.
I must read the documentation on multiple interfaces created by proxmox
upon creating each VM.