i set up lxd on my host system with lxdbr0 bridge as nic. Now my containers get their ip addresses via dhcp from lxdbr0 (in the range of 10.204.x.x).

Also i have 2 public ip addresses. One for the host (x.x.x.x) and one for the container (b.b.b.b). The container should use the second public ip for outgoing and ingoing traffic. Both public ip addresses go to the host system so my host system gets all traffic in the first place.

I already accomplished to set up a preroute (on the host) from my public ip to the private ip so that all incoming traffic for the public ip goes to a specific container.

BUT i can't figure out how to route the outgoing traffic FROM the container to the public ip. I've tried to set up a preroute like i did with the incoming traffic but no result.

iptables -L shows

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain /* managed by lxd-bridge */
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain /* managed by lxd-bridge */
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps /* managed by lxd-bridge */
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps /* managed by lxd-bridge */

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             /* managed by lxd-bridge */
ACCEPT     all  --  anywhere             anywhere             /* managed by lxd-bridge */

iptables -t nat -L shows

target     prot opt source               destination
DNAT       all  --  anywhere             ip-b.ip-b-b-b.eu  to:
DNAT       all  --  anywhere            to:b.b.b.b

b.b.b.b --> second public ip (for the container) --> containers (private) ip in the lxdbr0 bridge

Incoming traffic on the public ip gets routed to the container but the outgoing traffic from the container doesn't.

Also i set LXD_IPV4_NAT="false" in the lxd bridge config since this enabled the containers to use my hosts ip adress for outgoing traffic (which i don't want)

EDIT #1: route -n shows

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         x.x.x.1         UG    0      0        0 ens3   U     0      0        0 lxdbr0
x.x.x.1 UH    0      0        0 ens3

x.x.x.1 --> gateway of my hosts ip (x.x.x.x)

EDIT #2: Example

- pIP1 = public ip 1, should be used for host
- pIP2 = "      "  2, should be used for the container

the container runs on the host system.

container = (device lxdbr0)
host      = pIP1 (device ens3) and pIP2 (device ens3:0)

Outgoing packets from the container come with the source ip 
Now these packets should change the source ip to pIP2 and then sent to the 
gateway (so it appears to the router, that the packet from the container 
comes from the pIP2)
  • I'm not sure if that's your problem but I'm under the impression that you confuse NATing with routing which are similar but different concepts. What does your route -n look like? Jan 20, 2017 at 18:58
  • @JuliePelletier edited my question. I don't relly know if i am confused. I thought that PREROUTING means that iptables changes the source ip of the packet before it gets routed so logically it should be handled like it came from the replaced ip and ingoing packets do go to the private ip, thats why i am even more confused
    – SEUH
    Jan 20, 2017 at 19:15
  • Why don't you want to use the IP address of your host for your containers? Using NAT would be the normal thing to do. If you don't then you have to arrange that the hosts and routers locally know how to get to your network. If your "public ip" really is public, you are asking the world t know how to route to this network, which is not going to happen! (10.x.x.x is one of the RFC1918 reserved address ranges).
    – icarus
    Jan 20, 2017 at 19:23
  • @icarus because the containers should have their own public ip. The public ip routes to the host lxd system. So all packets to the public ip go first to my host. Then the host routes this traffic to the containers ip (10.x.x.x) which works. The problem is, that the outgoing traffic from the container (10.x.x.x) needs to be send as it comes from the public ip. Thats why i prerouted both, the public and the private ip but only incoming traffic works, not the outgoing
    – SEUH
    Jan 20, 2017 at 19:36
  • If the host handles the routing properly, then all packets going out of it will appear to come from its public IP. Not sure what you're trying to do here. Jan 20, 2017 at 19:46

1 Answer 1


All you need to do is to NAT the traffic coming from the container's private IP to the host's interface for the container's public IP ($publicIP2):

iptables -t nat -A POSTROUTING -s -j SNAT --to-source $publicIP2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .