I have a lxc-container with eth0 and ip The host has a bridge br0 with Both can ping each other. Further the host has a vpn wg0 and ip If I ping from inside the container to the vpn I get:

# ping PING ( 56(84) bytes of data. 64 bytes from icmp_seq=1 ttl=64 time=0.051 ms

Why is this? I expected no connection between both interfaces as forwarding and NAT are not enabled.


Unless I am mistaken, all local addresses (those belonging to the host) will react to a ping from any interface. It's not a question of forwarding, it's a question of recognizing the destination address as one of the local ones.

You can test this with tcpdump, and I would expect no packets to show up on wg0. You can also test by pinging some other host in, and you should get no answer. Another test is to use ip addr add ... to add a few other addresses to wg0 (or any other interface), and see if you can ping them after they are added.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.