0

I have a lxc-container with eth0 and ip 172.17.0.2/16. The host has a bridge br0 with 172.17.0.1/16. Both can ping each other. Further the host has a vpn wg0 and ip 172.16.0.1/16. If I ping from inside the container to the vpn I get:

# ping 172.16.0.1 PING 172.16.0.1 (172.16.0.1) 56(84) bytes of data. 64 bytes from 172.16.0.1: icmp_seq=1 ttl=64 time=0.051 ms

Why is this? I expected no connection between both interfaces as forwarding and NAT are not enabled.

2

Unless I am mistaken, all local addresses (those belonging to the host) will react to a ping from any interface. It's not a question of forwarding, it's a question of recognizing the destination address as one of the local ones.

You can test this with tcpdump, and I would expect no packets to show up on wg0. You can also test by pinging some other host in 172.16.0.0/16, and you should get no answer. Another test is to use ip addr add ... to add a few other addresses to wg0 (or any other interface), and see if you can ping them after they are added.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.