53 lines
2.2 KiB
Bash
53 lines
2.2 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Define and start the isolated NAT network "pve-net" with fixed DHCP
|
||
|
|
# reservations so each VM always gets the same IP.
|
||
|
|
set -euo pipefail
|
||
|
|
source "$(dirname "$0")/lab.env"
|
||
|
|
|
||
|
|
sudo -v # prompt for the sudo password once, up front
|
||
|
|
|
||
|
|
XML="${BUILD_DIR}/${NET_NAME}.xml"
|
||
|
|
cat > "$XML" <<EOF
|
||
|
|
<network>
|
||
|
|
<name>${NET_NAME}</name>
|
||
|
|
<forward mode='nat'/>
|
||
|
|
<bridge name='${NET_BRIDGE}' stp='on' delay='0'/>
|
||
|
|
<domain name='${DOMAIN}' localOnly='yes'/>
|
||
|
|
<ip address='${NET_GW}' netmask='255.255.255.0'>
|
||
|
|
<dhcp>
|
||
|
|
<range start='${NET_DHCP_START}' end='${NET_DHCP_END}'/>
|
||
|
|
<host mac='${PVE1_MAC}' name='${PVE1_NAME}' ip='${PVE1_IP}'/>
|
||
|
|
<host mac='${PVE2_MAC}' name='${PVE2_NAME}' ip='${PVE2_IP}'/>
|
||
|
|
<host mac='${STORE_MAC}' name='${STORE_NAME}' ip='${STORE_IP}'/>
|
||
|
|
</dhcp>
|
||
|
|
</ip>
|
||
|
|
</network>
|
||
|
|
EOF
|
||
|
|
|
||
|
|
echo "==> Defining network ${NET_NAME}"
|
||
|
|
if sudo virsh net-info "$NET_NAME" >/dev/null 2>&1; then
|
||
|
|
echo " already defined; recreating to pick up any changes"
|
||
|
|
sudo virsh net-destroy "$NET_NAME" 2>/dev/null || true
|
||
|
|
sudo virsh net-undefine "$NET_NAME" 2>/dev/null || true
|
||
|
|
fi
|
||
|
|
sudo virsh net-define "$XML"
|
||
|
|
sudo virsh net-autostart "$NET_NAME"
|
||
|
|
sudo virsh net-start "$NET_NAME"
|
||
|
|
|
||
|
|
echo "==> Network status"
|
||
|
|
sudo virsh net-info "$NET_NAME"
|
||
|
|
|
||
|
|
# On firewalld hosts, libvirt's NAT network often does not get FORWARD-accept
|
||
|
|
# rules, so guests can reach the host gateway but not the internet (apt on the
|
||
|
|
# storage VM then fails). Add explicit forward + masquerade for our subnet.
|
||
|
|
# Idempotent: '-C' checks for the rule before inserting.
|
||
|
|
echo "==> Ensuring host IP forwarding + NAT for ${NET_SUBNET}/${NET_PREFIX} (${NET_BRIDGE})"
|
||
|
|
sudo sysctl -wq net.ipv4.ip_forward=1
|
||
|
|
sudo iptables -t nat -C POSTROUTING -s "${NET_SUBNET}/${NET_PREFIX}" ! -d "${NET_SUBNET}/${NET_PREFIX}" -j MASQUERADE 2>/dev/null \
|
||
|
|
|| sudo iptables -t nat -I POSTROUTING -s "${NET_SUBNET}/${NET_PREFIX}" ! -d "${NET_SUBNET}/${NET_PREFIX}" -j MASQUERADE
|
||
|
|
sudo iptables -C FORWARD -i "${NET_BRIDGE}" -j ACCEPT 2>/dev/null || sudo iptables -I FORWARD -i "${NET_BRIDGE}" -j ACCEPT
|
||
|
|
sudo iptables -C FORWARD -o "${NET_BRIDGE}" -j ACCEPT 2>/dev/null || sudo iptables -I FORWARD -o "${NET_BRIDGE}" -j ACCEPT
|
||
|
|
|
||
|
|
echo
|
||
|
|
echo "Network up. Next: ./02-download-iso.sh"
|