Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup multiple LXC containers on a host, each with public static IPs of their own.

My host is running the latest Ubuntu. It has a single network interface named eth0. The static IPs are pingable from the internet and are named eth0:210, eth0:211... The numbers after the colon are the least significant byte of the addresses. In addition to these interfaces I have br0 setup on the host's public IP. There are also the lo, veth2LPP9A, and lxcbr0 interfaces. The lxcbr0 has the address of a private IP.

The host /etc/network/interfaces looks like:

auto br0
iface br0 inet static
        bridge_ports eth0
        bridge_fd 0

So far I've used various online sources, including Bridging LXC containers to host eth0 so they can have a public IP to help me set this up.

The container's config file has: = veth = br0

I've removed the static configuration from this file since it caused problems. When I ran lxc-ls --fancy with this configuration, I'd see the same public IP twice in the output. Additionally, it would mess with the subnet configuration of the container's /etc/network/interfaces.

Speaking of the container's interfaces file, it looks a bit like:

auto eth0
iface eth0 inet static
        address [...]
        #gateway [...]

        post-up route add [...] dev eth0
        post-up route add default gw [...]
        post-down route del [...] dev eth0
        post-down route del default gw [...]

I had to comment out the gateway and add the route add commands to this file. Otherwise, the container would take minutes to boot.

The /proc/sys/net/bridge/bridge-nf-* files on the host are all set to 0. The /proc/sys/net/ipv4/ip_forward value is 1.

The problem is, even though the container's "route -n" looks like it should, I can't ping out of the container. SSHing to what should be the container's IP, connects me to the host.

EDIT: Removing the container's static IP from the host did help, but now I'm getting a new error. Trying to ping the container from the host results in Redirect HostFrom , New nexthop. The packets are just going from the gateway to the host, repeatedly. Running a traceroute from the host shows that the first stop is at the gateway. Then all of the other routes are * * *. I get the same problem regardless if the container is online or not.

share|improve this question

In fact you can set the address and gateway from within the host and configure the container not to touch the interface at all using the keyword manual.

Place this within the guests /etc/network/interfaces:

auto eth0
iface eth0 inet manual

Also leave it up to the container's config file to set up the interface: = veth = up = lxc-bridge-nat = = auto

The guest will behave like it's BIOS already set up the interface and just use it.

Especially explore

share|improve this answer
Thx! This saved my life... my container would always try to get a new dhcp address... setting it to a fixed value inside the container (static) resulted in the container not even booting anymore! – Dominik Dorn Jul 21 '14 at 10:36
Note that this doesn't work well if the host is suspended and resumed. The lxc continues with its allocated ip-address but the host thinks it doesn't have an ip-address anymore. I have found it is better to configure the dnsmasq for lxc-net and handout a fixed address there. – HRJ Aug 19 '14 at 12:40
@HRJ - You should include the 'how' in your comment or link to the ref rather than just saying 'do it'. This is a technical site and you should say something actually useable. – Ian Macintosh Aug 19 '15 at 22:14
It seems like the correct place to do this is both in /etc/default/lxc where you can set your range (see LXC_DHCP_RANGE) and in /etc/dnsmasq.d-available/lxc as per the dnsmasq docs or manpage – Ian Macintosh Aug 19 '15 at 22:21

Since you are bridging, you need to set the IP addresses in the container only, and not on the host. The host should only have its own IP address(es).

share|improve this answer

I just did it the other day with Ubuntu 14.04. It is simple. You just have to edit the /etc/network/interfaces file inside your container, and set this:

auto eth0
iface eth0 inet static
 address $IP
 netmask $NETMASK
 gateway $GW
 dns-nameservers $DNS

Replace every variable with the desired value.

You DON'T have to do anything else!

PS: Notice the space before some lines. It is mandatory.

share|improve this answer
this resulted in my container not booting anymore (ubuntu 14.04 server).. the answer from sebastianwagner works for me. – Dominik Dorn Jul 21 '14 at 10:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.