dynamically nat lab devices behind the eve primary ip

6 June 2021   5 min read

This post explains how to configure EVE-NG as a DHCP server (isc-dhcp-server) assigning IPs to lab devices that are then dynamically NATed behind the primary EVE management IP address (iptables masquerade) to provide Internet breakout.


EVE has 10 bridges that are associated on a one-to-one basis to each physical NIC or vNIC. In the CLI these are called PNETs and in the GUI clouds. For example, cloud0 is mapped to pnet0 that is associated to eth0 which is the management NIC you use to connect to EVE.

root@hme-ubt-eve01:~# brctl show
bridge name bridge id STP enabled interfaces
pnet0 8000.005056a39b79 no eth0
pnet1 8000.005056a34db2 no eth1
pnet2 8000.005056a346b5 no eth2
pnet3 8000.000000000000 no
pnet4 8000.000000000000 no
pnet5 8000.000000000000 no
pnet6 8000.000000000000 no
pnet7 8000.000000000000 no
pnet8 8000.000000000000 no
pnet9 8000.000000000000 no

brctl is a tool used for managing the ethernet bridge configuration in the linux kernel, this link provides some some other useful brctl commands.

Cloud NAT takes one of these clouds and uses it for the purpose of Internet breakout. I find it a quick and simple way to give any lab device Internet access as all you need to do is to enable DHCP on the lab device and attach it to the cloud network.

DHCP Server

The first thing you need to do is install the DHCP server.

apt-get install isc-dhcp-server

Within the /etc/default/isc-dhcp-server DHCP server file define on which bridge the DHCP server should serve DHCP requests by adding this line to the bottom of the file. This is the pnet/cloud that you will put lab device in to give them Internet access.


The /etc/dhcp/dhcpd.conf DHCP configuration file defines the IP address information to be given out to the DHCP clients and makes EVE the authoritative server for that local network.


subnet netmask {
interface pnet9;
default-lease-time 600;
max-lease-time 7200;
option domain-name 'stesworld.com';
option domain-name-servers,;
option broadcast-address;
option subnet-mask;
option routers;}

The following commands can be used to verify and troubleshoot the DHCP process.

dhcpd -t                                           Check the syntax of dhcpd.conf file for errors
systemctl start isc-dhcp-server Start the service
systemctl enable isc-dhcp-server Enable it to start at each boot

service isc-dhcp-server status Check the service is running with no errors
cat /var/lib/dhcp/dhcpd.leases See the IP addresses assigned by DHCP and their lease times

The DHCP service status will show as status=1/FAILURE) with the error Not configured to listen on any interfaces! until the interface (pnet9) has been assigned an IP address.

Apply temporary

The following configuration will not survive a reboot so is useful if you want to first test the solution works.

  • Add an IP address from within the DHCP range to the pnet bridge interface

    ip address add dev pnet9

  • Enable IP routing in the linux kernel

    echo 1 > /proc/sys/net/ipv4/ip_forward

  • PAT the DHCP range to the pnet0 IP address (EVE management interface address)

    iptables -t nat -A POSTROUTING -o pnet0 -s -j MASQUERADE

Apply permanent

The following configuration applies cloud NAT permanently so that it will survive reboots.

  • Add an IP address within the DHCP range to the pnet bridge interface by editing /etc/network/interfaces

    iface eth9 inet manual
    auto pnet9
    iface pnet9 inet static
    bridge_ports eth9
    bridge_stp off

  • Enable IP routing in linux kernel by editing /etc/sysctl.conf

    net.ipv4.ip_forward = 1

  • PAT the DHCP range to the pnet0 IP address (EVE mgmt interface address) by installing and editing iptables-persistent

    apt-get install iptables-persistent
    iptables -t nat -A POSTROUTING -o pnet0 -s -j MASQUERADE
    netfilter-persistent save


iptables -t nat -L                                         To check IP table rules
iptables -t nat -v -L POSTROUTING -n --line-number Show the statistics (pkts/bytes), NATs and the line-number

cat /var/lib/dhcp/dhcpd.leases Holds the IP addresses assigned by DHCP and their lease times

brctl show Displays the association between physical interfaces, pnets and lab device ports
brctl showmacs pnet1 Shows MAC addresses in this bridge

Port based NATs

In some situations you may want port based NATs to allow RDP, SSH or HTTPS access to a device within your EVE lab. I find this particularly useful when hosting EVE in Azure. Below are a few useful examples of what you can do, they once again use iptables.

  • Traffic to on port 3389 is forwarded to on 3389

    iptables -t nat -A POSTROUTING -p tcp -d --dport 3389 -j DNAT --to-destination

  • HTTPS traffic is forwarded to lab device Note, this will break all internet access to 443 as it applies to all HTTPS traffic

    iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to

  • Connections inbound on port 444 are forwarded to on port 443 (so that it doesn’t break HTTPS for other devices)

    iptables -t nat -A PREROUTING -p tcp --dport 444 -j DNAT --to

  • Connections inbound on port 23 are forwarded to on port 22 (so that it doesn’t break SHH access to EVE itself)

    iptables -t nat -A PREROUTING -p tcp --dport 23 -j DNAT --to

  • Also ties the NAT to an exact interface (pnet1)

    iptables -t nat -A PREROUTING -p tcp -i pnet1 --dport 443 -j DNAT --to

  • Forwards traffic from the specific source address on port 443 to

    iptables -t nat -A PREROUTING -s -p tcp --dport 443 -j DNAT --to

To delete any of the iptable entries you need to get the rule line-number with the first command and use that in the second command to delete it.

iptables -t nat -v -L PREROUTING -n --line-number
iptables -t nat -D PREROUTING the_line_number