1

I try to setup a LXC container with bridged network on ubuntu 14.04.1, but the outgoing traffic seems to be blocked. Ping another IP than the container's one is not working. Actually I tried this with a working container of a ubuntu 12.04 host moved to new hardware and a recent ubuntu 14.04, but the problem also applies to a new created ubuntu 14.04 container.

I should mention that if I bind the IP address to an aliasing interface of the host directly, pinging inside and outside to the host is working correctly.

I hope someone has an idea what I am doing wrong.

I created a the new container with:

lxc-create -t ubuntu -n ubuntu-test

This is my config file:

# Template used to create this container: /usr/share/lxc/templates/lxc-ubuntu
# Parameters passed to the template: -r trusty
# For additional config options, please look at lxc.container.conf(5)

# Common configuration
lxc.include = /usr/share/lxc/config/ubuntu.common.conf

# Container specific configuration
lxc.rootfs = /var/lib/lxc/ubuntu-test/rootfs
lxc.mount = /var/lib/lxc/ubuntu-test/fstab
lxc.utsname = ubuntu-test
lxc.arch = amd64

# Network configuration
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br0
lxc.network.hwaddr = 00:16:3e:6c:7c:79
lxc.network.ipv4=91.143.88.119/24
lxc.network.ipv4.gateway=91.143.88.1
lxc.network.name=eth0

My '/etc/network/interfaces' on the host:

auto lo
iface lo inet loopback

auto br0
iface br0 inet static
    address 81.7.15.233
    netmask 255.255.255.0
    broadcast 81.7.15.255
    gateway 81.7.15.1
    bridge_ports eth0
    bridge_fd 0
    bridge_stp off
    bridge_waitport 0
    bridge_maxwait 0

and on the client:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
    address 91.143.88.119
    netmask 255.255.255.0
    broadcast 91.143.88.255
    gateway 91.143.88.1

IP forwarding is enabled:

cat /proc/sys/net/ipv4/ip_forward 
1

'iptables-save' shows

# Generated by iptables-save v1.4.21 on Wed Sep 10 18:26:23 2014
*mangle
:PREROUTING ACCEPT [20035:4192692]
:INPUT ACCEPT [7193:3225426]
:FORWARD ACCEPT [2677:191017]
:OUTPUT ACCEPT [381:36624]
:POSTROUTING ACCEPT [3058:227641]
-A POSTROUTING -o lxcbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Wed Sep 10 18:26:23 2014
# Generated by iptables-save v1.4.21 on Wed Sep 10 18:26:23 2014
*nat
:PREROUTING ACCEPT [10474:819973]
:INPUT ACCEPT [282:41644]
:OUTPUT ACCEPT [7:537]
:POSTROUTING ACCEPT [57:4274]
-A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE
COMMIT
# Completed on Wed Sep 10 18:26:23 2014
# Generated by iptables-save v1.4.21 on Wed Sep 10 18:26:23 2014
*filter
:INPUT ACCEPT [7193:3225426]
:FORWARD ACCEPT [2677:191017]
:OUTPUT ACCEPT [381:36624]
-A INPUT -i lxcbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i lxcbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i lxcbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -i lxcbr0 -p udp -m udp --dport 67 -j ACCEPT
-A FORWARD -o lxcbr0 -j ACCEPT
-A FORWARD -i lxcbr0 -j ACCEPT
COMMIT
# Completed on Wed Sep 10 18:26:23 2014

output of 'brctl show'

bridge name bridge id       STP enabled interfaces
br0         8000.0025905700f8   no      eth0
                                        vethRTX30H
lxcbr0      8000.000000000000   no      

My host's ifconfig:

br0       Link encap:Ethernet  Hardware Adresse 00:25:90:57:00:f8  
      inet Adresse:81.7.15.233  Bcast:81.7.15.255  Maske:255.255.255.0
      inet6-Adresse: fe80::225:90ff:fe57:f8/64 Gültigkeitsbereich:Verbindung
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
      RX-Pakete:128248 Fehler:0 Verloren:15 Überläufe:0 Fenster:0
      TX-Pakete:3835 Fehler:0 Verloren:0 Überläufe:0 Träger:0
      Kollisionen:0 Sendewarteschlangenlänge:0 
      RX-Bytes:11076138 (11.0 MB)  TX-Bytes:343557 (343.5 KB)

eth0      Link encap:Ethernet  Hardware Adresse 00:25:90:57:00:f8  
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
      RX-Pakete:129421 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
      TX-Pakete:4046 Fehler:0 Verloren:0 Überläufe:0 Träger:0
      Kollisionen:0 Sendewarteschlangenlänge:1000 
      RX-Bytes:13510902 (13.5 MB)  TX-Bytes:449527 (449.5 KB)
      Interrupt:16 Speicher:fb900000-fb920000 

lo        Link encap:Lokale Schleife  
      inet Adresse:127.0.0.1  Maske:255.0.0.0
      inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
      UP LOOPBACK RUNNING  MTU:65536  Metrik:1
      RX-Pakete:2 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
      TX-Pakete:2 Fehler:0 Verloren:0 Überläufe:0 Träger:0
      Kollisionen:0 Sendewarteschlangenlänge:0 
      RX-Bytes:176 (176.0 B)  TX-Bytes:176 (176.0 B)

lxcbr0    Link encap:Ethernet  Hardware Adresse ae:2c:57:c2:f0:24  
      inet Adresse:10.0.3.1  Bcast:10.0.3.255  Maske:255.255.255.0
      inet6-Adresse: fe80::ac2c:57ff:fec2:f024/64 Gültigkeitsbereich:Verbindung
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
      RX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
      TX-Pakete:8 Fehler:0 Verloren:0 Überläufe:0 Träger:0
      Kollisionen:0 Sendewarteschlangenlänge:0 
      RX-Bytes:0 (0.0 B)  TX-Bytes:648 (648.0 B)

vethRTX30H Link encap:Ethernet  Hardware Adresse fe:97:2b:8e:90:8a  
      inet6-Adresse: fe80::fc97:2bff:fe8e:908a/64 Gültigkeitsbereich:Verbindung
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
      RX-Pakete:39 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
      TX-Pakete:14826 Fehler:0 Verloren:0 Überläufe:0 Träger:0
      Kollisionen:0 Sendewarteschlangenlänge:1000 
      RX-Bytes:3282 (3.2 KB)  TX-Bytes:1466740 (1.4 MB)

My container's 'ifconfig'

eth0      Link encap:Ethernet  Hardware Adresse 00:16:3e:6c:7c:79  
      inet Adresse:91.143.88.119  Bcast:91.143.88.255  Maske:255.255.255.0
      inet6-Adresse: fe80::216:3eff:fe6c:7c79/64 Gültigkeitsbereich:Verbindung
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
      RX-Pakete:20082 Fehler:0 Verloren:2 Überläufe:0 Fenster:0
      TX-Pakete:40 Fehler:0 Verloren:0 Überläufe:0 Träger:0
      Kollisionen:0 Sendewarteschlangenlänge:1000 
      RX-Bytes:2005479 (2.0 MB)  TX-Bytes:3368 (3.3 KB)

lo        Link encap:Lokale Schleife  
      inet Adresse:127.0.0.1  Maske:255.0.0.0
      inet6-Adresse: ::1/128 Gültigkeitsbereich:Maschine
      UP LOOPBACK RUNNING  MTU:65536  Metrik:1
      RX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Fenster:0
      TX-Pakete:0 Fehler:0 Verloren:0 Überläufe:0 Träger:0
      Kollisionen:0 Sendewarteschlangenlänge:0 
      RX-Bytes:0 (0.0 B)  TX-Bytes:0 (0.0 B)

'tail /proc/sys/net/bridge/*' on the host

==> /proc/sys/net/bridge/bridge-nf-call-arptables <==
0

==> /proc/sys/net/bridge/bridge-nf-call-ip6tables <==
0

==> /proc/sys/net/bridge/bridge-nf-call-iptables <==
0

==> /proc/sys/net/bridge/bridge-nf-filter-pppoe-tagged <==
0

==> /proc/sys/net/bridge/bridge-nf-filter-vlan-tagged <==
0

==> /proc/sys/net/bridge/bridge-nf-pass-vlan-input-dev <==
0

finally 'ping 8.8.8.8' in the container:

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2015ms
  • Your public IP is not on the same network as your host. so it is more a hardware / network problem then a configuration problem. – Panther Sep 10 '14 at 18:39
  • You are right, but I also tried a public IP of the same network as the host. Then I was able to ping to host from inside the container, but still even the gateway was not reachable. On the other hand, isn't a bridge exactly for this situation, having different networks on the same hardware device via virtual devices mapped on the same bridge? – othiman Sep 11 '14 at 7:36
  • Normally a bridge allows you to be on the same network . so host 192.168..1.10 and guest 192.168.1.100. The alternates are NAT which puts the guest on a private network such as 10.10.10.100. In your case your problem is routing. You will need to configure the host (with NAT) to send traffic to the guest or put the host and guest on the same network. See linux-kvm.org/page/AnthonyLiguori/Networking and similar. – Panther Sep 11 '14 at 15:58
  • Actually a bridge device allows you to have just one network card, but let it look like you multiple. This way (or by using alias devices) you can use the same network card for different subnets. I don't want to use NAT because it causes big problems, e.g., for VoIP servers, since SIP is not really build with NAT in mind. – othiman Sep 23 '14 at 11:35
  • Also the case for me. Have you been able to find solution? – Dmytro Leonenko Dec 10 '14 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.