How to set up 2 networks, one of which is virtual?

Question

linux

Colleagues, hello!
In the office, a cord comes to us from a provider with one static IP. It sticks into the router, to which a bunch of machines are connected. The router distributes IP addresses from the 192.168.2.0/24 network via DHCP. Everything works as it should.
Now we have purchased a server, plugged a patch cord from the router into it, the server received its IP address (for example, 192.168.2.200). Inside the server, we installed KVM, created a NAT network (virbr1, virbr1-nic. DHCP distributes IP addresses on the 192.168.5.0/24 network), which goes to the Internet through the enp2s0 physical interface. Virtual machines have access to the Internet, everything is fine.
What you need: to enable from the network 192.168.2.0/24 to access virtual machines on the network 192.168.5.0/24. At first, I acted simply: I set up a static route on the router (with a packet at 192.168.5.0/24, the packet goes to 192.168.2.200). Then, on the server itself, I configured iptables to forward packets from enp2s0 to virbr1 if the recipient's IP is on the 192.168.5.0/24 network. And everything seemed to work. Only there was a strange moment - some people did not connect to 192.168.5.0. Neither SSH nor HTTP. But others were fine.
What is interesting: how are such networks generally organized? How to properly configure iptables for such tasks? Would a bridge work for this?
Don't hit hard, I'm not a system administrator, I just have to set up the network in the office, I acquired knowledge along the way.

Answer 1

but in the main network, addresses are issued by DHCP, while virtual machines would like to have static addresses

For a specific MAC, a dedicated IP (DHCP setting). Or inside, turn off DHCP and set up a permanent IP.

Answer 2

add to /etc/sysctl.conf :
in the console do:
iptables is not needed if both networks have the same physical gateway

Answer 3

Oh, the experts came running. I'll try to explain in Chainikov's way. The easiest way to solve your problem is to connect virtual machines to the network not using a private subnet behind nat, but using a bridge (bridge), so the network with your virtual machines becomes part of the 192.168.2.0 network, and 192.168.5.0 becomes unnecessary - the virtual machines are assigned addresses from the main network. A more complicated case, if there is a need to separate the subnet with virtual machines (to make it easier to understand, it is better to abstract from the concept of a virtual network, from the point of view of OSI, this is a regular subnet with hosts) from the main network. As you understand, for routing between subnets, there must be some entity that unites two L3 subnets, in your case this entity is your router. In short, it has a separate port for the 192.168.5.0/24 subnet, the port itself is assigned an address from this subnet, for example 192.168.5.1, a hypervisor must be connected to this port, the hypervisor itself is also assigned an address from this subnet, the default gateway for it will be 192.168.5.1. As in the first case, virtual machines are connected to the network through a bridge (we remember, in fact, this is just a switch), addresses are also assigned from 192.168.5.0, and the gateway for them is also 192.168.5.1 - that is, the hypervisor, virtual machines - that's all, from the point of view of the network are separate hosts. After that, everyone is happy, traffic between subnets goes through the router, without strange crutches in the form of port forwarding and other unconventional entertainment. Consider the most difficult case, the hypervisor must be on the same network (192.168.2.0), and the virtual machines on the other (192.168.5.0). VLAN technology will help us with this. A port is also allocated on the router, but it should work in trunk mode (in a tricky way, combining two or more L2 domains within one physical segment), in general, this is still the same second case, only with the vlan interfaces configured as on a hypervisor as well as on the router. As you understand, an ordinary home router will not work for the second and third cases (unless, of course, it has been brought to mind with an alternative openwrt firmware).
Something like this. it would be possible to give more detailed advice if you indicate the model of your router and which hypervisor you are using.

Answer 4

You don't need nat inside kvm. Do it everywhere inside the route, and nat only outside.