Fedora – dnsmasq für vmbr0

Fedora – Interne Bridge vmbr0 mit generischem NAT (firewalld)

Ziel

• Bridge vmbr0 mit 192.168.16.1/24
• Internes Netz 192.168.16.0/24
• Permanenter Carrier über dummy0
• DHCP/DNS über dnsmasq
• NAT unabhängig vom verwendeten Uplink (LAN, WLAN, etc.)
• NAT über firewalld (kein iptables, kein rc.local)

Bugfix für noarp

• vi /etc/NetworkManager/dispatcher.d/pre-up.d/dummy.sh

#!/bin/bash
if test "$1" = "dummy0"
then
 ip link set dummy0 arp on
fi

• chmod +x /etc/NetworkManager/dispatcher.d/pre-up.d/dummy.sh

Bridge und Dummy Device

Modul laden und persistent machen

• modprobe dummy
• echo "dummy" > /etc/modules-load.d/dummy.conf

Netzwerkbrücke erstellen

• nmcli con add type bridge autoconnect yes con-name vmbr0 ifname vmbr0
• nmcli con modify vmbr0 ipv4.addresses 192.168.16.1/24
• nmcli con modify vmbr0 ipv4.method manual
• nmcli con modify vmbr0 ipv6.method ignore
• nmcli con up vmbr0

Dummy-Device zur Brücke hinzufügen

• nmcli con add type dummy con-name dummy0 ifname dummy0 master vmbr0
• nmcli con modify dummy0 ipv4.method disabled
• nmcli con modify dummy0 ipv6.method ignore
• nmcli con modify dummy0 connection.autoconnect yes
• nmcli con up dummy0

Forwarding

IP-Forwarding aktivieren

• echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/99-ipforward.conf
• sysctl --system

firewalld

1. Interfaces den richtigen Zonen zuweisen

sudo nmcli connection modify vmbr0 connection.zone internal sudo nmcli connection modify enp2s0f1 connection.zone external sudo nmcli connection modify wlxb0dcef324aa1 connection.zone external

1. Interfaces neu starten

sudo nmcli connection down vmbr0; sudo nmcli connection up vmbr0 sudo nmcli connection down enp2s0f1; sudo nmcli connection up enp2s0f1 sudo nmcli connection down wlxb0dcef324aa1; sudo nmcli connection up wlxb0dcef324aa1

1. Firewall-Regeln (einmalig)

sudo firewall-cmd --permanent --zone=internal --add-forward sudo firewall-cmd --permanent --zone=external --add-masquerade sudo firewall-cmd --permanent --zone=internal --add-service={dhcp,dns,ssh} sudo firewall-cmd --permanent --zone=external --add-service={ssh}

1. Regeln laden

sudo firewall-cmd --reload

1. Prüfen

sudo firewall-cmd --get-active-zones sudo firewall-cmd --zone=internal --list-all sudo firewall-cmd --zone=external

dnsmasq

Installation

• dnf install dnsmasq -y

Konfiguration

• vi /etc/dnsmasq.d/vmbr0.conf

interface=vmbr0
bind-interfaces

domain=lab.local
expand-hosts

dhcp-range=192.168.16.100,192.168.16.200,12h
dhcp-option=option:router,192.168.16.1
dhcp-option=option:dns-server,192.168.16.1

listen-address=192.168.16.1

Dienst aktivieren

• systemctl enable --now dnsmasq

Kontrolle

• ip addr show vmbr0
• ip addr show dummy0
• firewall-cmd --list-all --zone=internal
• reboot