我有一台运行 Proxmox 的专用服务器和一台在 Proxmox 内部运行的 VMDebian 7（喘息）。
由于我只有一个 IP 地址，因此我使用iptables将端口转发至虚拟机。
我的/etc/network/interfaces：
# The loopback network interface
auto lo
iface lo inet loopback
# For routing
auto vmbr1
iface vmbr1 inet manual
post-up /etc/pve/kvm-networking.sh
bridge_ports dummy0
bridge_stp off
bridge_fd 0
# vmbr0: Bridging. Make sure to use only MAC adresses that were assigned to you.
auto vmbr0
iface vmbr0 inet static
address 91.121.<redacted>
netmask 255.255.255.0
network 91.121.<redacted>.0
broadcast 91.121.<redacted>.255
gateway 91.121.<redacted>.254
bridge_ports eth0
bridge_stp off
bridge_fd 0
iface vmbr0 inet6 static
address 2001:41D0:1:A790::1
netmask 64
post-up /sbin/ip -f inet6 route add 2001:41D0:1:A7ff:ff:ff:ff:ff dev vmbr0
post-up /sbin/ip -f inet6 route add default via 2001:41D0:1:A7ff:ff:ff:ff:ff
pre-down /sbin/ip -f inet6 route del default via 2001:41D0:1:A7ff:ff:ff:ff:ff
pre-down /sbin/ip -f inet6 route del 2001:41D0:1:A7ff:ff:ff:ff:ff dev vmbr0
auto vmbr2
iface vmbr2 inet static
address 10.21.21.254
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
pre-up echo 1 > /proc/sys/net/ipv4/ip_forward
pre-up iptables-restore < /etc/iptables.rules
iptable 规则如下所示（以及更多端口，但它们或多或少看起来都相同）：
-A PREROUTING -i vmbr0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.21.21.4:80
-A POSTROUTING -s 10.21.21.0/24 -o vmbr0 -j MASQUERADE
有一个网站正在使用Node.js，由代理Nginx全部在虚拟机内运行。
我的 Nginx 配置是：
upstream node {
server 127.0.0.1:4567;
}
server {
listen 80;
server_name myDomain.co.uk;
location / {
proxy_pass http://node;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
proxy_redirect off;
proxy_buffering off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}
}
当我 ping 我的域名时，它工作正常：
PING myDomain.co.uk (my.ip.address) 56(84) bytes of data.
64 bytes from myHostName.eu (my.ip.address): icmp_req=1 ttl=64 time=0.282 ms
64 bytes from myHostName.eu (my.ip.address): icmp_req=2 ttl=64 time=0.275 ms
64 bytes from myHostName.eu (my.ip.address): icmp_req=3 ttl=64 time=0.284 ms
64 bytes from myHostName.eu (my.ip.address): icmp_req=4 ttl=64 time=0.339 ms
然而当尝试卷曲，它拒绝连接。
curl --verbose myDomain.co.uk
* About to connect() to myDomain.co.uk port 80 (#0)
* Trying my.ip.address...
* Connection refused
* couldn't connect to host
* Closing connection #0
curl: (7) couldn't connect to host
编辑：
我已将规则更改为（根据@FrederikNielsen 的建议）：
-A PREROUTING -d my.ip.address/32 -p tcp -m multiport --dports 80 -j DNAT --to-destination 10.21.21.4
-A POSTROUTING -s 10.21.21.0/24 -o vmbr0 -j MASQUERADE
-A POSTROUTING -s 10.21.21.0/24 -d 10.21.21.4/32 -p tcp -m multiport --dports 80 -j SNAT --to-source my.ip.address
但还是没运气。错误已更改为：
* About to connect() to myDomain.co.uk port 80 (#0)
* Trying my.ip.address...
* Connection timed out
* couldn't connect to host
* Closing connection #0
curl: (7) couldn't connect to host
答案1
您将要进行一些发夹 NAT。
这个问题有一个很好的答案可以解释如何做到这一点。
另一种解决方案可能是使用分割水平 DNS 设置，但这涉及的设置比发夹 NAT 要多一些。
更新：
-A PREROUTING -d externalIP/32 -p tcp -m multiport --dports 80 -j DNAT --to-destination 10.21.21.4
-A POSTROUTING -s 10.21.21.0/24 -o vmbr0 -j MASQUERADE
-A POSTROUTING -s 10.21.21.0/24 -d 10.21.21.4/32 -p tcp -m multiport --dports 80 -j MASQUERADE
更新 #2：
-A PREROUTING -d externalIP -p tcp --dport 80 -j DNAT --to-destination 10.21.21.4
-A POSTROUTING -s 10.21.21.0/24 -d 10.21.21.4 -p tcp --dport 80 -j SNAT --to-source routerInternalIP