Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to virtualize my webserver with lxc/virsh for this reason, I want to pass a IP to the lxc container. But my IPs are from different subnets, what I tried (but not successfully):

Virsh network:

<interface type='bridge'>
    <source bridge='br0'/>
    <model type='virtio'/>

IP 1: xxx.xxx.184.96 (Dedicated Server IP)

xxx.xxx.37.220 (For LXC)


auto lo
iface lo inet loopback

# The primary network interface
auto eth0

iface eth0 inet static
        address xxx.xxx.184.96
        network xxx.xxx.184.0
        broadcast xxx.xxx.184.127
        gateway xxx.xxx.184.1
        # dns-* options are implemented by the resolvconf package, if installed

iface br0 inet static
        bridge_ports eth0
        bridge_stp on
        address xxx.xxx.37.220
share|improve this question

You can't use a bridge interface to forward traffic between subnets. Bridges are meant for joining two layer 2 networks, not 2 subnets (which are layer 3). You have to route traffic between the networks instead.
Well, technically you could bridge them, but it requires you to add a routing rule to every single host on both subnets letting them know that they can communicate directly with the other subnet. This is very cumbersome and I doubt is what you want to do.

So, routing traffic. Basically you have to turn your hypervisor box into a small router. You have to tell it that any incoming traffic to certain ports it should forward on to your virtualized instance. Then when the virtualized instance replies, your hypervisor box modifies the traffic to make it look like the traffic came from itself. This is done via DNAT.

iptables -t nat -I PREROUTING -i eth0 -p tcp -m multiport --dports 80,443 -j DNAT --to-destination

This rule says to take any traffic coming in eth0 to TCP ports 80 & 443 and forward it on to (change to the IP of your virtualized web server).

Now you need to save this rule so that when you reboot your system, it comes back up. This part will vary. There is a iptables-persistent package in Ubuntu which will let you do /etc/init.d/iptables-persistent save. But if you're using something else for managing your firewall, you'll need to use that instead.

share|improve this answer
That is what i wanto to avoid, if i would use nat I dont't need two ips. – shim_ Nov 25 '13 at 18:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.