Proxmox NAT configuration for virtual machines

@bsuphal, welcome to the VHT forums. I'm glad you have joined the community! This sounds like you would like to configure the Proxmox hosts to NAT the virtual machine traffic. The virtual machines would have private IP addresses and you would have a "public" address for your Proxmox hosts. 

Take a look at the following network configuration that is documented here: 

Proxmox VE Administration Guide

3.4.6. Masquerading (NAT) with iptables
Masquerading allows guests having only a private IP address to access the network by using the host IP address for outgoing traffic. Each outgoing packet is rewritten by iptables to appear as originating from the host, and responses are rewritten accordingly to be routed to the original sender.

auto lo
iface lo inet loopback

auto eno1
#real IP address
iface eno1 inet static
        address  198.51.100.5/24
        gateway  198.51.100.1

auto vmbr0
#private sub network
iface vmbr0 inet static
        address  10.10.10.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eno1 -j MASQUERADE

Proxmox makes mention that in some cases the following is needed:

Note In some masquerade setups with firewall enabled, conntrack zones might be needed for outgoing connections. Otherwise the firewall could block outgoing connections since they will prefer the POSTROUTING of the VM bridge (and not MASQUERADE).
Adding these lines in the /etc/network/interfaces can fix this problem:

post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

I have not used OVS before. Do you know if you have the ability to tag VLANs underneath the hosts? Just thinking through this, to have both private virtual networks on both hosts to "talk" to one another, you would need for those to be on the same network for both Proxmox hosts. This should be possible technically if you can do that from the OVS side.

You would NAT VM traffic on both hosts, have a VLAN that is common between the two Proxmox servers for the VM traffic, so that VMs on each host could talk to each other if that is a requirement. Then each VM's traffic would assume the IP address of the Proxmox server host as it connects to the Internet.

@brandon-lee - Thank you for replying back.

Yes it has ability to enable vlan tag underneath the hosts. And as per present config both Hosts are in same private network and can talk with each other. The only solution I am looking for is, all VM's that are bridged on Private network interface and Private IP should be able to communicate with Internet via Hosts Public IP Or vRack Public IP whatever is possible.

I hope I was able to answer your above questions with this reply.

@bsuphal i believe the configuration for a NAT'ed Proxmox bridge would work fine for your use case and would be the configuration you would want to use for this type of network configuration. You also may not need VLANs for the bridge interface as well, but may require some testing. The VMs should get NAT'ed as the IP address of the host itself and should communicate with the other host as well. However, I would do some testing with this configuration before going into production to make sure the assumption here work as expected.