From 1d878a8d4513306ab9b007c6a91da06b808a693b Mon Sep 17 00:00:00 2001 From: Adyrem Date: Sat, 16 May 2026 13:46:48 +0200 Subject: [PATCH] Scope port 80/443 DNAT to Proxmox public IP only MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without -d 192.168.1.10, the DNAT rule intercepted all TCP port 80/443 traffic arriving on vmbr0 — including LAN or routed traffic destined for internal VMs like Pi-hole (10.10.1.2), redirecting it to Traefik instead. Co-Authored-By: Claude Sonnet 4.6 --- proxmox/network-interfaces | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/proxmox/network-interfaces b/proxmox/network-interfaces index f244e6c..da8151f 100644 --- a/proxmox/network-interfaces +++ b/proxmox/network-interfaces @@ -10,10 +10,10 @@ iface vmbr0 inet static bridge-ports nic0 bridge-stp off bridge-fd 0 - post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 80 -j DNAT --to-destination 10.10.1.3:80 - post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 443 -j DNAT --to-destination 10.10.1.3:443 - post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 80 -j DNAT --to-destination 10.10.1.3:80 - post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 443 -j DNAT --to-destination 10.10.1.3:443 + post-up iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 80 -j DNAT --to-destination 10.10.1.3:80 + post-up iptables -t nat -A PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 443 -j DNAT --to-destination 10.10.1.3:443 + post-down iptables -t nat -D PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 80 -j DNAT --to-destination 10.10.1.3:80 + post-down iptables -t nat -D PREROUTING -i vmbr0 -d 192.168.1.10 -p tcp --dport 443 -j DNAT --to-destination 10.10.1.3:443 post-up iptables -t nat -A PREROUTING -i vmbr0 -p udp --dport 53 -j DNAT --to-destination 10.10.1.2:53 post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 53 -j DNAT --to-destination 10.10.1.2:53 post-up iptables -t nat -A POSTROUTING -p udp -d 10.10.1.2 --dport 53 -j MASQUERADE