I also submitted this as a Fedora bug question, here.

I'm not sure if this is a bug, but here is my sudden issue.

The Linux/LXC single-box cluster setup

  • I use Fedora x86_64 (currently Fedora-25) as the LXC/HOST O/S. I use CentOS-6 x86_64 (currently CentOS-6.9 Final) for the six (qty. 6) LXC/GUEST O/S'.

  • This was working for a long time (a few years), but suddenly does not after a 'sudo dnf -y update' (HOST) and 'sudo yum -y update' (GUESTS). It has been a few months since I booted this HOST/GUESTS LXC "cluster" and, as usual, O/S updates are the first thing that I perform. This may provide a hint if some underlying system-level component(s)/behavior(s) changed during that time.

  • The Fedora HOST and CentOS-6 GUESTS are on the same subnet, and share the same default router:; (all standard stuff).

  • The Fedora Host does not have any firewall/firewalld RPM packages installed, and therefore doesn't not run a firewall. I removed this long ago to simplify things.

The issue

  • After performing the above O/S updates to the HOST and GUESTS, from within any GUEST, I can no longer (a) successfully ping/ssh guest-to-guest or (b) ping the default router.

  • I can, however, ping/ssh HOST-to-GUEST and GUEST-to-HOST with no issue.

  • From any computer outside this setup -- which, by the way, are also on the same subnet and share the same default router as above -- I can ping/ssh to the HOST but cannot to any of the GUESTS.

  • Other than performing the aforementioned O/S updates, I didn't alter anything.

Some output

  • Here is output from the HOST: HOST.txt

  • Here is output from a GUEST: ONE_GUEST.txt

  • Note that the GUESTS are named vps00, vps01, vps02, vps03, vps04 and vps10, and have identical configurations except MAC and IP addresses (so I only provided output for one of them). While the HOST is named lxc-host. Throughout the attachments, you'll see some in-line notes that I annotated them with.

Any ideas? Thank you in advance. :)

1 Answer 1


Thanks to the accepted answer in this POST, I was able to finally figure out the iptables(1M) entries that were missing. Here they are:

sudo iptables -A INPUT -i eth0 -j ACCEPT
sudo iptables -A INPUT -i br0 -j ACCEPT
sudo iptables -A FORWARD -i br0 -j ACCEPT

I don't know what Fedora HOST O/S changes occurred to make these entries not be there suddenly (meaning after doing "dnf -y update; reboot" after a few months of not doing that), but would sure love to know because now I have to hardcode these entries in somewhere (which I'm not thrilled about LoL).

I hope this helps others who bridge their LXC guests like I do.


Here are the sequence of commands I used to permanently incorporate them, after interactively executive the above commands (in-memory):

root# cd /etc/sysconfig/
root# cp iptables iptables.FCS               # Backup the current contents.
root# iptables-save > ./iptables             # Overwrite with in-memory contents.
root# reboot
root# sudo systemctl start iptables.service  # Not yet committed.
root# sudo iptables -L -n -v | more          # Inspect in-memory. changes
root# sudo systemctl enable iptables.service # If all looks good, commit them permanently.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.