2

I have a machine running Ubuntu 16.04 with two LXC containers on top of it ubuntu_lxc and ubuntu_lxc1. The machine has two physical network interfaces. I would like to explicitly bridge each interface to each container, and to completely separate network traffic between the two containers for the purpose of running two different services, each on one of the containers.

The two physical interfaces are supposed to have DHCP, PPPoE or static IP addresses which I shall configure accordingly in /etc/network/interfaces.

I am using this guide http://www.itzgeek.com/how-tos/linux/ubuntu-how-tos/setup-linux-container-with-lxc-on-ubuntu-16-04-14-04.html to create the containers and the bridging.

These are details of bridging (in the host machine): cat /etc/network/interfaces

# The loopback network interface
auto lo
iface lo inet loopback

### bridge name ###

auto br0
auto br1

### bridge information ###

#br0
iface br0 inet dhcp

bridge_ports enp2s0
bridge_stp off
bridge_fd 9

# br1
iface br1 inet dhcp

bridge_ports enp1s0
bridge_stp off
bridge_fd 9

# The primary network interface
auto enp2s0
iface enp2s0 inet dhcp

# second network interface
auto enp1s0
iface enp1s0 inet dhcp

In this case I am using DHCP for both interfaces.

These are the interfaces I have (in the host machine): ifconfig

br0       Link encap:Ethernet  HWaddr 00:e0:81:bb:cc:71  
          inet addr:192.168.0.102  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::2e0:81ff:febb:cc71/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1994 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:386641 (386.6 KB)  TX bytes:2004 (2.0 KB)

br1       Link encap:Ethernet  HWaddr 00:e0:81:bb:cc:70  
          inet addr:10.0.1.2  Bcast:10.0.1.255  Mask:255.255.255.0
          inet6 addr: fe80::2e0:81ff:febb:cc70/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:55 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:23506 (23.5 KB)  TX bytes:1332 (1.3 KB)

enp1s0    Link encap:Ethernet  HWaddr 00:e0:81:bb:cc:70  
          inet addr:10.0.1.2  Bcast:10.0.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2092 errors:0 dropped:0 overruns:0 frame:0
          TX packets:218 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:601774 (601.7 KB)  TX bytes:39572 (39.5 KB)
          Interrupt:16 Memory:fdee0000-fdf00000 

enp2s0    Link encap:Ethernet  HWaddr 00:e0:81:bb:cc:71  
          inet addr:192.168.0.102  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:164151 errors:0 dropped:0 overruns:0 frame:0
          TX packets:23218 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:226362607 (226.3 MB)  TX bytes:1829585 (1.8 MB)
          Interrupt:17 Memory:fdfe0000-fe000000 

Looking at dynamically assigned IP addresses, I suspect that br0 is successfully bridged to enp2s0 and br1 to enp1s0.

This is configuration of containers in the host machine: cat /etc/lxc/default.conf

lxc.network.type = veth
lxc.network.link = br0
lxc.network.flags = up
lxc.network.hwaddr = 00:16:3e:xx:xx:xx



lxc.network.type = veth
lxc.network.link = br1
lxc.network.flags = up
lxc.network.hwaddr = 00:16:3e:xx:xx:xx

I also suspect that this configuration associates the first container to br0 and the second container to br1.

I can ping to the internet from both containers. But I don't seem to be able to verify if the traffic is isolated or not.

ifconfig from ubuntu_lxc (first container):

eth0      Link encap:Ethernet  HWaddr 00:16:3e:77:2b:9c  
          inet addr:192.168.0.103  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::216:3eff:fe77:2b9c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:20 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3978 (3.9 KB)  TX bytes:1332 (1.3 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifconfig from ubuntu_lxc1 (second container):

eth0      Link encap:Ethernet  HWaddr 00:16:3e:f4:b8:f9  
          inet addr:192.168.0.106  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::216:3eff:fef4:b8f9/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:69 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:14203 (14.2 KB)  TX bytes:1332 (1.3 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

The question is : Why is ubuntu_lxc1 container assigned an IP address that's different from br1 in the host machine(which is supposed to be associated with this container)?

How do I associate a physical interface to a specific container only?

And how do I verify that traffic isolated?

  • The container specific configuration shouldn't be in /etc/lxc/default.conf. This will probably give two interfaces per container, and both will request/receive their configuration on the 1st only: both on br0, as verified by an IP in the same LAN for both. There is indeed no isolation. The choice of ifconfig over ip address doesn't help to detect the issue. – A.B Aug 5 '18 at 9:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.