How to configure external IP addresses for LXC guests?

Question

I'm exploring the LXC features in Ubuntu 12.04 and I really want to set up a network like this:

client1:   192.168.56.101/24
lxc-host:  192.168.56.102/24
guest1     192.168.56.201/24
guest2     192.168.56.202/24
guest3     192.166.56.203/24

I just want a "flat" network where the guests have full access to the LAN and are visible from the clients. I'm used to bridged networking with libvirt/KVM, as described here: http://libvirt.org/formatdomain.html#elementsNICSBridge

On the host:

# /etc/network/interfaces
auto br0
iface br0 inet static
    address 192.168.56.102
    netmask 255.255.255.0
    broadcast 192.168.56.255
    bridge_ports eth1

lxc.conf for the first guest:

# /var/lib/lxc/guest1/config:
lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up
lxc.network.hwaddr=00:16:3e:13:48:4e
lxc.network.ipv4=192.168.56.201/24

It looks like 192.168.56.201 is invisible to the outside world, which isn't what I want. Seems like I have to do one of these things:

1) Manually set up routing on the host and guest

2) Do something hokey...create virtual interfaces on the host ahead of time, and configure the guests to use them lxc.network.type=phys. I don't know if that would actually work.

I'm focused on Ubuntu, but answers for RHEL/Fedora would be useful too....

Answer 1

This is pretty much right—though you're missing a line like this:

lxc.network.ipv4.gateway = X.X.X.X

I have an LXC guest running on Debian. First, you set up the host bridge (the easy way), in /etc/network/interfaces:

auto wan
iface wan inet static
        address 72.X.X.X
        netmask 255.255.255.0
        gateway 72.X.X.1
        bridge_ports wan_phy    # this line is important.
        bridge_stp off
        bridge_fd 2
        bridge_maxwait 20

In your case, you've called it br0, and I've called it wan. The bridge can be called anything you want. You get this working first—if it fails, investigate with (e.g.,) brctl

Then your LXC config is set up to join that bridge:

lxc.utsname = FOO
lxc.network.type = veth
lxc.network.link = wan                  # remember, this is what I call my bridge
lxc.network.flags = up
lxc.network.name = v-wan                # optional, I believe
lxc.network.ipv4 = 72.X.X.Y/24          # different IP than the host
lxc.network.ipv4.gateway = 72.X.X.1     # same as on the host

As HoverHell notes, someone with root in the container can change the IP address. Yep. It's a bridge (aka Ethernet switch). If you want to prevent that, you can use firewall rules on the host—at least in my case, the packets need to go through the host's iptables.

Answer 2

I haven't gotten fully into LXC,

but i have setup multiple containers with there own static ip's in lan which provide internet services for some of my websites...

Maybe this can help, on what you want for yours.

I run multiple containers, like so,

ON HOST MACHINE I Edited The Host's File, Adding Each Container & Host Machine: vi /etc/hosts

lxc host machine:   192.168.1.100
container1:   192.168.1.101
container2:     192.168.1.102
container3:   192.168.56.102
container4:   192.166.56.103

after saving...

Again, On the host machine i set network & bridge to:

# /etc/network/interfaces
auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0
        bridge_maxwait 0
        **address** 192.168.1.100
        netmask 255.255.255.0
        **network 192.168.1.1**
        **broadcast** 192.168.1.100
        gateway 192.168.1.1
        dns-nameservers 8.8.8.8 8.8.4.4

above the network is my router ip, for lan. (internal) address & broadcast is host machine, internal ip, which i later use a VHOST for internet access, webservers, ftp, etc.

FOR LXC CONTAINERS 1-4 I SETUP CONFIG LIKE SO:

LXC CONFIG
lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up
lxc.network.hwaddr=00:16:3e:13:48:4e
**lxc.network.ipv4=192.168.1.101**

now Container 1 IP = 192.168.1.101

i repeat for additional containers to have there own static ip on the lan..

in container 1-4,

log in from the host:

lxc-console -n CONTAINERNAME,

& i set each containers network to static, eth0 to:

auto eth0
iface eth0 inet static
        address 192.168.1.101
        netmask 255.255.255.0
        network 192.168.0.0
        broadcast 192.168.1.101
        gateway 192.168.1.1
        dns-nameservers 8.8.8.8 8.8.4.4

EACH OF THE CONTAINERS HAS IT OWN IP, (local) AVAILABLE ON THE LAN. U CAN SSH EACH INDIVIDUAL LOCAL IP, TO TEST USING PUTTY!

After that im pretty sure u should figure out how to run them via internet after, example, vhost to container ip / load balancers / proxy / etc..

Maybe this setup can help out in anyway.

Answer 3

I haven't played yet with LXC, but this article should help you out: network configuration using ethernet bridges (check Method 2).

To give you some hint about the configuration (I assume you have br0 properly ocnfigured already):

1. You need to create a pair of veth device using ip link add type veth
2. The previous command has created 2 virtual interfaces: veth0 and veth1
3. Now add the virtual interface veth0 to the bridge: brctl addif br0 veth0
4. in your lxc shell, type: ns_exec -nm -- /bin/bash
5. Now we have to set the other virtual if to the network namespace of the lxc shell: ip link set veth1 netns PID_OF_LXC_SHELL
6. Now by configuring veth1 in the lxc shell to the IP address you want (e.g. 192.168.56.201) you should be all set.

Answer 4

LXD client CLI, lxc, allows setting up Network Interface type; set it to macvlan for default profile.

lxc profile device set default eth0 nictype macvlan

Containers using default profile will have a LAN IP.