2

I'm currently trying to give an LXC container internet access using nftables, but I don't seem to get it right whatsoever.

The setup is the following: The host has a WAN interface (enp1s0) and a bridge (lxcbrd). I am not using lxc-net, but a bridge I made myself as follows :

allow-hotplug enp1s0
iface enp1s0 inet dhcp

auto lxcbrd
iface lxcbrd inet static
        bridge_ports none
        bridge_fd 0
        bridge_maxwait 0
        address 10.0.0.254
        netmask 255.255.255.0

The LXC container is configured to use lxcbrd...

lxc.network.type = veth
lxc.network.link = lxcbrd
lxc.network.ipv4 = 10.0.0.1/24
lxc.network.flags = up
lxc.network.hwaddr = 00:16:3e:98:34:26
lxc.network.ipv4.gateway = auto

... and it seems it succeeds to some extent :

2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether [REDACTED] brd ff:ff:ff:ff:ff:ff
    inet [REDACTED] brd [REDACTED] scope global enp1s0
       valid_lft forever preferred_lft forever
    inet6 [REDACTED] scope link 
       valid_lft forever preferred_lft forever
3: lxcbrd: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether fe:5f:9a:9b:75:a4 brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.254/24 brd 10.0.0.255 scope global lxcbrd
       valid_lft forever preferred_lft forever
    inet6 fe80::6414:77ff:fe2d:6699/64 scope link 
       valid_lft forever preferred_lft forever
5: vethPPYOVI@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master lxcbrd state UP group default qlen 1000
    link/ether fe:5f:9a:9b:75:a4 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet6 fe80::fc5f:9aff:fe9b:75a4/64 scope link 
       valid_lft forever preferred_lft forever

On the host, nftables is configured to nat and forward :

table ip nat {
        chain prerouting {
                type nat hook prerouting priority 0; policy accept;
        }

        chain postrouting {
                type nat hook postrouting priority 0; policy accept;
                oifname "enp1s0" masquerade
        }
}
table inet filter {
        chain input {
                type filter hook input priority 0; policy drop;
                ct state { established, related} accept comment "accept all traffic originated from us"
                ct state invalid drop comment "drop invalid packets"
                iif "lo" accept comment "accept all loopback traffic"
                icmp type { router-advertisement, destination-unreachable, parameter-problem, time-exceeded} accept comment "ICMP"
                icmpv6 type { nd-neighbor-solicit, time-exceeded, destination-unreachable, packet-too-big, nd-neighbor-advert, parameter-problem, nd-router-advert} accept comment "ICMPv6"
                tcp dport 2222 ct state new accept comment "ssh"
                udp dport 60000-61000 ct state new accept comment "mosh"
        }

        chain forward {
                type filter hook forward priority 0; policy accept;
                iifname "lxcbrd" oifname "enp1s0" accept
                iifname "enp1s0" oifname "lxcbrd" accept
        }

        chain output {
                type filter hook output priority 0; policy accept;
        }
}

From inside the container :

6: eth0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:16:3e:98:34:26 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.0.0.1/24 brd 10.0.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::216:3eff:fe98:3426/64 scope link 
       valid_lft forever preferred_lft forever

However, I do not have internet access whatsoever from inside the container. From the host, I can ping the container without any issue.

UPDATE: with this configuration, I can't even ping the gateway (which is 10.0.0.254), but I can ping another container on the same subnet (10.0.0.0/24). If I set nftables chain inet filter input to policy accept, I can ping the gateway, but not an IP outside the subnet (such as 8.8.8.8); I'm not entirely sure as to why it behaves like that considering the rule that should allow all icmp traffic.

UPDATE2: after an echo 1 > /proc/sys/net/ipv4/ip_forward (I was sure I already did set this in /etc/sysctl.conf... apparently did not), I am able to ping WAN IPs (such as 8.8.8.8), and resolve DNS after manually adding Google DNS servers into /etc/resolv.conf. However, I cannot ping the gateway which is the address of the bridge interface (10.0.0.254) if nftables chain inet filter input is set to policy drop.

Does someone see something extremely wrong with my configuration?

Thanks for the help !

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.