Linux – Routing requests from external hostnames to internal IP addresses in Ubuntu

(Third re-write)

You can do pieces of this.

You can define two virtual switches on your ESXi system. Call one "internal" for the 10.x.x.x stuff and one "external" for the single 98.x.x.x address you have been assigned.

Connect one physical Ethernet port to the "external" vswitch.

Define a firewall VM with two ethernet devices. Attach one to the "external" vswitch, and assign the interface the 98.x.x.x IP you have been given. Attach the firewall VM's second ethernet device to the "internal" switch and give it an IP on the 10.x.x.x subnet. This will end up being the default router for all the other VMs on the box.

Each other VM you create should be added to the "internal" vswitch with a 10.x.x.x subnet, and use the firewall's 10.x.x.x IP as its default router.

Add the ESXi management interface to the "internal" vswitch with a 10.x.x.x subnet, and use the firewall's 10.x.x.x IP as its default router.

Configure the firewall to NAT traffic from internal to external. This will permit the internal VMs to talk to the internet.

Now at this point, the internet cannot talk back to them (ie if you had a web server on the 10.x.x.x subnet) because the internet doesn't know anything about your 10.x.x.x subnet and so packets never make it to your internal VMs. Besides, you probably have the firewall configured to drop said packets even if they did make it to your system. So you cannot "route" to your VMs over the internet.

So you probably want to do one or both of the following:

• Set up one or more port forwards on the external interface of the firewall VM to pass inbound traffic back to a particular VM. So for example you'd port-forward port 80 on your firewall's external interface back to your webserver VM, and port-forward port 981 (maybe? might be something else, check your manual) back to the management interface on your ESXi server.

and/or

• Set up a VPN from wherever you are back to the firewall VM, and route traffic across that directly to the "internal" network.

For setup purposes, if you have two physical interfaces, you can add the second physical interface to the "internal" vswitch. This will mean if you do have physical access to the system, you can plug a laptop (via a crossover cable, probably) directly into the "internal" network and configure things directly. This will also give you emergency access should the firewall VM die for some reason.

In your second topology, you appear to have a split subnet. 192.168.8.0/24 spans multiple switches which you state are layer 3. In your output from switch2, you have a static route for this /24 pointing at a single interface:

S      192.168.8.0/24 [1/0] via 10.58.3.254,   vlan 3

This means that traffic hitting switch2 destined for either 192.168.8.254 or 192.168.8.11 will be forwarded to the same next hop. At least one of those destinations

In order for this to work as you intend, you have a couple of options:

1. Configure switch[123] as layer 2 switches, such that the 192.168.8.0/24 is again a single broadcast domain.
2. Configure separate networks on each of the links: {device1 -> switch1, switch1 -> switch2, etc}