2

I have an Ubuntu 14.04 LXD container on an Ubuntu 14.04 Server host (using lxd-git-master PPA). I want to prevent it from reaching any other containers or from communicating with the public Internet over any IP range except for a specific /32 block (that is, one IP). This IP is statically routed to my server in a datacenter and I need to be able to specify the IP, subnet, and default gateway.

I read that LXD itself does not do networking, so what program/utility specifically is the easiest to install and configure in a direct way to explicitly configure this?

P.S. I need it to be able to bind to all possible TCP and UDP ports on that IP address, and it would be ideal if the host would not try to bind to the IP when it starts up a process that binds on 0.0.0.0.

1 Answer 1

2

You probably want to route that public IP to your container, so make sure the host itself doesn't have it in its network configuration, then do something like:

ip route add IP/32 via CONTAINER-IP dev lxcbr0

You may then add the public IP to the container's network config by adding this to its network config under the eth0 section:

post-up ip addr add IP/32 dev eth0

At which point you should be able to ping the container using the public IP.

You'll want to make sure the host doesn't NAT traffic coming from that IP and as for restricting access to other resources from the container, you'd have to do that with iptables on the host. Note that one nice property of Linux bridges is that iptables does get called on intra-bridge traffic, so you can absolutely firewall the container from accessing any neighbor.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .