Fedora – dnsmasq für vmbr0

Fedora – Interne Bridge vmbr0 mit generischem NAT (firewalld)

Ziel

• Bridge vmbr0 mit 192.168.16.1/24
• Internes Netz 192.168.16.0/24
• Permanenter Carrier über dummy0
• DHCP/DNS über dnsmasq
• NAT unabhängig vom verwendeten Uplink (LAN, WLAN, etc.)
• NAT über firewalld (kein iptables, kein rc.local)

Bugfix für noarp

• vi /etc/NetworkManager/dispatcher.d/pre-up.d/dummy.sh

#!/bin/bash
if test "$1" = "dummy0"
then
 ip link set dummy0 arp on
fi

• chmod +x /etc/NetworkManager/dispatcher.d/pre-up.d/dummy.sh

Bridge und Dummy Device

Modul laden und persistent machen

• modprobe dummy
• echo "dummy" > /etc/modules-load.d/dummy.conf

Netzwerkbrücke erstellen

• nmcli con add type bridge autoconnect yes con-name vmbr0 ifname vmbr0
• nmcli con modify vmbr0 ipv4.addresses 192.168.16.1/24
• nmcli con modify vmbr0 ipv4.method manual
• nmcli con modify vmbr0 ipv6.method ignore
• nmcli con up vmbr0

Dummy-Device zur Brücke hinzufügen

• nmcli con add type dummy con-name dummy0 ifname dummy0 master vmbr0
• nmcli con modify dummy0 ipv4.method disabled
• nmcli con modify dummy0 ipv6.method ignore
• nmcli con modify dummy0 connection.autoconnect yes
• nmcli con up dummy0

Forwarding

IP-Forwarding aktivieren

• echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/99-ipforward.conf
• sysctl --system

Firewall

Zone der Bridge über NetworkManager setzen

• nmcli connection modify vmbr0 connection.zone internal
• nmcli connection modify enp2s0f1 connection.zone external
• nmcli connection modify wlxb0dcef324aa1 connection.zone external
• nmcli connection down vmbr0
• nmcli connection up vmbr0
• nmcli connection down enp2s0f1
• nmcli connection up enp2s0f1
• nmcli connection down wlxb0dcef324aa1
• nmcli connection up wlxb0dcef324aa1

Forwarding und Masquerading aktivieren

• firewall-cmd --permanent --zone=internal --add-forward
• firewall-cmd --permanent --zone=external --add-masquerade

ALLES erlauben (keine Service-Einschränkungen)

• firewall-cmd --permanent --zone=internal --remove-service={dhcp,dns,ssh}
• firewall-cmd --permanent --zone=external --remove-service=ssh

Rich-Regeln für kompletten Durchgriff

• firewall-cmd --permanent --zone=internal --add-rich-rule='rule family="ipv4" source address="192.168.16.0/24" accept'
• firewall-cmd --permanent --zone=internal --add-rich-rule='rule family="ipv4" destination address="192.168.16.0/24" accept'

Regeln laden

• firewall-cmd --reload

Kontrolle

• firewall-cmd --get-active-zones

dnsmasq

Installation

• dnf install dnsmasq -y

Konfiguration

• vi /etc/dnsmasq.d/vmbr0.conf

interface=vmbr0
bind-interfaces

domain=lab.local
expand-hosts

dhcp-range=192.168.16.100,192.168.16.200,12h
dhcp-option=option:router,192.168.16.1
dhcp-option=option:dns-server,192.168.16.1

listen-address=192.168.16.1

Dienst aktivieren

• systemctl enable --now dnsmasq

Kontrolle

• ip addr show vmbr0
• ip addr show dummy0
• firewall-cmd --list-all --zone=internal
• reboot