Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am facing some problems that the eth0 on lxc container does not work. I already tried Bridging LXC containers to host eth0 so they can have a public IP, but it does not help.

On my host (Ubuntu on virtualbox):

# cat /proc/sys/net/ipv4/ip_forward
1

config

# cat /var/lib/lxc/config
lxc.config
lxc.utsname=ubuntu
lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up

I created a container with the above config

# lxc-create -t centos -f config -n centos1

then launch

# lxc-start -d -n centos1
# lxc-console -n centos1

It seems veth is properly connected because the host machine says

# brctl show
bridge name    bridge id           STP enabled    interfaces
br0            8000.080027bb0aca   no             eth0
                                                  veth48BKPz
lxcbr0         8000.000000000000   no

And the default gateway seems also be set correctly on the host

# route -n
Kernel IP routing table
Destination    Gateway        Genmask          Flags    Metric  Ref   Use  Iface
0.0.0.0        192.168.11.1   0.0.0.0          UG       100     0       0  br0
10.0.3.0       0.0.0.0        255.255.255.0    U        0       0       0  lxcbr0
192.168.11.0   0.0.0.0        255.255.255.0    U        0       0       0  br0

On the lxc container

# route -n
Kernel IP routing table
Destination    Gateway        Genmask          Flags    Metric  Ref   Use  Iface
0.0.0.0        192.168.11.1   0.0.0.0          UG       0       0       0  eth0
169.254.0.0    0.0.0.0        255.255.0.0      U        1009    0       0  eth0
192.168.11.0   0.0.0.0        255.255.255.0    U        0       0       0  eth0

Any help?

share|improve this question

1 Answer 1

Do you have iptables (or ip6tables) enabled on your host ? If you do, you need to ACCEPT the traffic on the FORWARD chain of your bridge with:

iptables -A FORWARD -p all -i br0 -j ACCEPT

The reason is that the br-nf (bridge-net filter) option is enabled by default in the 2.6 kernel, so the bridged traffic goes through iptables. You could disable it by doing:

echo 0 > /proc/sys/net/bridge/bridge-nf-call-arptables
echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables
echo 0 > /proc/sys/net/bridge/bridge-nf-call-ip6tables

Follow this link for more information on ebtables/iptables interaction on a Linux-based bridge.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.