Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm exploring the LXC features in Ubuntu 12.04 and I really want to set up a network like this:

client1:   192.168.56.101/24
lxc-host:  192.168.56.102/24
guest1     192.168.56.201/24
guest2     192.168.56.202/24
guest3     192.166.56.203/24

I just want a "flat" network where the guests have full access to the LAN and are visible from the clients. I'm used to bridged networking with libvirt/KVM, as described here: http://libvirt.org/formatdomain.html#elementsNICSBridge

On the host:

# /etc/network/interfaces
auto br0
iface br0 inet static
    address 192.168.56.102
    netmask 255.255.255.0
    broadcast 192.168.56.255
    bridge_ports eth1

lxc.conf for the first guest:

# /var/lib/lxc/guest1/config:
lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up
lxc.network.hwaddr=00:16:3e:13:48:4e
lxc.network.ipv4=192.168.56.201/24

It looks like 192.168.56.201 is invisible to the outside world, which isn't what I want. Seems like I have to do one of these things:

1) Manually set up routing on the host and guest

2) Do something hokey...create virtual interfaces on the host ahead of time, and configure the guests to use them lxc.network.type=phys. I don't know if that would actually work.

I'm focused on Ubuntu, but answers for RHEL/Fedora would be useful too....

share|improve this question
    
Follow up: I set br0 to promiscuous mode and it seems to be doing what I want now. I guess this is standard practice but it wasn't covered in any of the many LXC tutorials I read through. I'll leave this question open for a time in case I get any feedback... –  twblamer Oct 8 '12 at 22:15
    
I did approximately the same (except with a bit more manual setting up): netup script in each lxc config to add veth to the bridge (on the host), manual IP setup in each container, additional script / interface in each container to set up routing (via ip4 forwarding on host). But, as far as I see, both solutions mean that container can set own IP address to pretty much anything (and also adding the primary interface of the host to a bridge is slightly inconvenient). So I'm also interested in some feedback/solution. –  HoverHell Oct 28 '12 at 13:32

3 Answers 3

up vote 5 down vote accepted

This is pretty much right—though you're missing a line like this:

lxc.network.ipv4.gateway = X.X.X.X

I have an LXC guest running on Debian. First, you set up the host bridge (the easy way), in /etc/network/interfaces:

auto wan
iface wan inet static
        address 72.X.X.X
        netmask 255.255.255.0
        gateway 72.X.X.1
        bridge_ports wan_phy    # this line is important.
        bridge_stp off
        bridge_fd 2
        bridge_maxwait 20

In your case, you've called it br0, and I've called it wan. The bridge can be called anything you want. You get this working first—if it fails, investigate with (e.g.,) brctl

Then your LXC config is set up to join that bridge:

lxc.utsname = FOO
lxc.network.type = veth
lxc.network.link = wan                  # remember, this is what I call my bridge
lxc.network.flags = up
lxc.network.name = v-wan                # optional, I believe
lxc.network.ipv4 = 72.X.X.Y/24          # different IP than the host
lxc.network.ipv4.gateway = 72.X.X.1     # same as on the host

As HoverHell notes, someone with root in the container can change the IP address. Yep. It's a bridge (aka Ethernet switch). If you want to prevent that, you can use firewall rules on the host—at least in my case, the packets need to go through the host's iptables.

share|improve this answer
4  
Thanks everyone. It's kind of sad, but I just came back to this, found this through google and forgot I was the original asker... –  twblamer Aug 28 '13 at 23:59

I haven't gotten fully into LXC,

but i have setup multiple containers with there own static ip's in lan which provide internet services for some of my websites...

Maybe this can help, on what you want for yours.

I run multiple containers, like so,

ON HOST MACHINE I Edited The Host's File, Adding Each Container & Host Machine: vi /etc/hosts

lxc host machine:   192.168.1.100
container1:   192.168.1.101
container2:     192.168.1.102
container3:   192.168.56.102
container4:   192.166.56.103

after saving...

Again, On the host machine i set network & bridge to:

# /etc/network/interfaces
auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0
        bridge_maxwait 0
        **address** 192.168.1.100
        netmask 255.255.255.0
        **network 192.168.1.1**
        **broadcast** 192.168.1.100
        gateway 192.168.1.1
        dns-nameservers 8.8.8.8 8.8.4.4

above the network is my router ip, for lan. (internal) address & broadcast is host machine, internal ip, which i later use a VHOST for internet access, webservers, ftp, etc.

FOR LXC CONTAINERS 1-4 I SETUP CONFIG LIKE SO:

LXC CONFIG
lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up
lxc.network.hwaddr=00:16:3e:13:48:4e
**lxc.network.ipv4=192.168.1.101**

now Container 1 IP = 192.168.1.101

i repeat for additional containers to have there own static ip on the lan..

in container 1-4,

log in from the host:

lxc-console -n CONTAINERNAME,

& i set each containers network to static, eth0 to:

auto eth0
iface eth0 inet static
        address 192.168.1.101
        netmask 255.255.255.0
        network 192.168.0.0
        broadcast 192.168.1.101
        gateway 192.168.1.1
        dns-nameservers 8.8.8.8 8.8.4.4

EACH OF THE CONTAINERS HAS IT OWN IP, (local) AVAILABLE ON THE LAN. U CAN SSH EACH INDIVIDUAL LOCAL IP, TO TEST USING PUTTY!

After that im pretty sure u should figure out how to run them via internet after, example, vhost to container ip / load balancers / proxy / etc..

Maybe this setup can help out in anyway.

share|improve this answer

I haven't played yet with LXC, but this article should help you out: network configuration using ethernet bridges (check Method 2).

To give you some hint about the configuration (I assume you have br0 properly ocnfigured already):

  1. You need to create a pair of veth device using ip link add type veth
  2. The previous command has created 2 virtual interfaces: veth0 and veth1
  3. Now add the virtual interface veth0 to the bridge: brctl addif br0 veth0
  4. in your lxc shell, type: ns_exec -nm -- /bin/bash
  5. Now we have to set the other virtual if to the network namespace of the lxc shell: ip link set veth1 netns PID_OF_LXC_SHELL
  6. Now by configuring veth1 in the lxc shell to the IP address you want (e.g. 192.168.56.201) you should be all set.
share|improve this answer
    
You haven't tested this at all? You'll probably get the bounty, but your answer does not help me at all and I have the exact same setup as OP. –  Jonas G. Drange Feb 17 '13 at 21:27
    
How can I help you more? Was there one step in my answer that did no work, or did you perform them and it did not solve the problem? Nope, as said in my answer, LXC is on my wishlist of stuff to do, but I haven't started yet real testing. –  Huygens Feb 18 '13 at 7:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.