OS: Ubuntu 15.10
LXD: 2.0.0.rc5

I would like to know how to access a container from another computer on the same local network.

Address of my PC (the LXD host): (enp3s0)
Xenial container: (eth0), (lxcbr0)
Other PC (Fedora 23): (wlp3s0)

I can ping from the other PC to the LXD host and the otherwise.


There's several different ways to accomplish what you want.

  1. Forward required ports from host to guest
  2. Route networks
  3. Bridge devices

Options 1 and 2 require ip-forwarding to be enabled on the host:

# run time:
sudo sysctl -w net.ipv4.ip_forward=1

# permanent:
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/30-virt-network

Easiest is 1 if you want to access specific service like http (port 80) on guest (you access guest port 80 with host ip-address+port), but you cannot run host services on that same port.

# on lxd host: (-i HOSTDEVICE to lan, usually enp3s0 or eth0)
sudo iptables -t nat -A PREROUTING -i enp3s0 -p tcp -m tcp --dport 80 -j DNAT --to
# making this permanent is left to the reader (because that depends on your choice of fw setup)

Option 2 is more tricky and depends on how much you can modify your network.

Check that (sudo iptables -L -n) says that chain FORWARD (policy ACCEPT) or sudo iptables -I FORWARD -s -j ACCEPT allow it specifically. Now either on the network firewall route to your host or test with route on the

sudo ip route add via dev wlp3s0

Third option would bring your lxd guests to your lan as part of the lan. See Instruction converting eth0 (enp3s0 in your case) to bridge how to do it. In short:

  1. Create bridge device on host
  2. Add eth0 or enp3s0 to that bridge
  3. Set host address to bridge (not enp3s0)
  4. Bind lxd guest devices to that bridge

    stop network-manager
    brctl addbr br0
    brctl addif br0 enp3s0
    ifconfig enp3s0 up
    ifconfig br0 up
    dhclient br0
    lxc profile edit default
      - change lxcbr0 to br0
  • I went with option 2 (route). The missing information was that I need to enable ip-forwarding, thanks. – Paradiesstaub Mar 26 '16 at 16:28
  • Just wondering, is -t nat missing in the iptables -A PREROUTING statement? – neuhaus Oct 28 '16 at 10:00
  • @neuhaus, that would be yes. Fixed. – Manwe Oct 28 '16 at 12:38
  • This works but in my case I also had to put the bridge up sudo ip link set br0 up – Jeune Nov 2 '16 at 1:18
  • @Jeune ifconfig br0 up should have done the same. But good that you got it working. – Manwe Nov 2 '16 at 7:20

You need to tell the other computer how to reach the container because the other computer is on a different subnet than the container. That is, you need to set up a "route". Below is a sample route you can create on the other computer. It says, "to get to the container (.181) first go through the host (.112) using the device that is on the same network as the host (eth0). If the other computer uses a different device then change accordingly. Note that this route is not permanent; it will not survive a reboot. Google to find how to set up a permanent route.

sudo ip route add via dev eth0
  • Result is: Cannot find device "eth0". I tried with enp3s0, too. As described in the updated question above I can ping from LXD host to the Fedora laptop and otherwise. I guess with using the device that is on the same network as the host did you mean, using the same router, right? When comparing the output of route's default value, the only difference between the LXD host and the laptop is, that the host has Metric 100 and Fedora Metric 600 (beside the Iface name). – Paradiesstaub Mar 25 '16 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.