Can't connect to external IP from local network behind iptables NAT
<p>We have Proxmox vitual environmenet witch couple of virtual machines. Host server have multiple external IP adresses. We use iptables to forward connections to certain external IP+port to selected virtual machine. And we use NAT for outgoing connections from VMs.</p>

<p>So far everything works. Problem occurs when VMs try to connect to host external IP it's not working.</p>

<p>As far as i understand what we need is hairpin NAT (NAT reflection). But we are not able to get it working by instructions we found.</p>

<p>Our iptables rules:</p>

<pre><code># === FIREWALL ===
*filter
:INPUT ACCEPT [3174:1555907]
:FORWARD ACCEPT [2521:547542]
:OUTPUT ACCEPT [2753:2039466]
:fail2ban-ssh - [0:0]

# allow returnig packets
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# drop all other
-A INPUT -p tcp -d 1.2.3.4/32 -j DROP

COMMIT

# === NAT ===

*nat
:PREROUTING ACCEPT [140854:7345476]
:POSTROUTING ACCEPT [2635:170444]
:OUTPUT ACCEPT [25596:1617170]

# INCOMING
-A PREROUTING  -d 1.2.3.4/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.60.10:80
-A PREROUTING  -d 1.2.3.4/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.0.60.10:443
-A PREROUTING  -d 1.2.3.4/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.0.60.20:80

# OUTGOING
-A POSTROUTING -d 10.0.60.10 -s 10.0.0.0/16 -p tcp --dport 80 -j SNAT --to 10.0.0.1
-A POSTROUTING -o vmbr0 -j SNAT --to-source 1.2.3.4

COMMIT
</code></pre>

<p>1.2.3.4 - external IP of host</p>

<p>10.0.60.10, 10.0.60.20 - internal IPs of VMs</p>

<p>10.0.0.1 - internal IP of host</p>