實例 https://www.facebook.com/groups/pve.tw/permalink/1225387670963125/
楊凱麟
以下也是我目前interfaces的設定
其中1.2.3.x為真實IP
1.2.3.Y為IDC提供的gateway
設置完後再將區網設定填上10.0.0.X (X=0~255)
即可上網,連外網的公共IP會是1.2.3.X
----network configuration----
auto lo
iface lo inet loopback
iface eno1 inet manual
auto vmbr0
iface vmbr0 inet static
address 1.2.3.X
netmask 255.255.255.248
network 1.2.3.0
broadcast 1.2.3.255
gateway 1.2.3.Y
bridge_ports eno1
bridge_stp off
bridge_fd 0
auto vmbr1
iface vmbr1 inet static
address 10.0.0.254
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.21.21.0/24' -o vmbr0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.21.21.0/24' -o vmbr0 -j MASQUERADE
post-up iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 2222 -j DNAT --to 10.21.21.5:22
post-down iptables -t nat -D PREROUTING -i vmbr0 -p tcp --dport 2222 -j DNAT --to 10.21.21.5:22
https://forum.proxmox.com/threads/pfsense-proxmox-5-one-nic.41512/#post-208059
==============
- CSF firewall can focus vmbr2
#############################
https://download.configserver.com/csf/readme.txt11. Multiple Ethernet Devices
If you have multiple ethernet NICs that you want to apply all rules to, then you can set ETH_DEVICE to the interface name immediately followed by a plus sign. For example, eth+ will apply all iptables rules to eth0, eth1, etc.
That said, if you leave ETH_DEVICE blank all rules will be applied to all ethernet devices equally.
#############################
#############################
https://www.dmehosting.com/clients/knowledgebase.php?action=displayarticle&id=79&language=chinese
2. Edit /etc/csf/csf.conf, set the following parameters:
ETH_DEVICE = "venet0"
MONOLITHIC_KERNEL = "1"
VERBOSE = "0"
2. Edit /etc/csf/csf.conf, set the following parameters:
ETH_DEVICE = "venet0"
MONOLITHIC_KERNEL = "1"
VERBOSE = "0"
- CSF iptables nat
https://blackonsole.org/how-to-add-nat-iptables-rules-with-csf/