I don't understand the modes of lxc network.

I'd like to have 4 guests: apache1, apache2, database and frontdoor

frontdoor is a squid which decides which apache should be used

It works perfectly on vservers, when all of guests has a dummy interface (isolated from web) and frontdoor has two interfaces real eth0 and dummy

Now I migrate to lxc, and instead of dummy I use bridge (on host) and mode=veth (on guests)

I'm not happy seeing four vethLIJG3f in ifconfig, but let's see its ok.

the problem is, that I CAN'T get to squid. I'm trying to iptables -t NAT -A PREROUTING -p tcp --dport 80 -j DNAT --to-dest but it simply doesn't work.

I wonder if I should change veth to something else?


Well this interesting, I'm playing with a vserver and I do not really understand how it works with eth and dummy.

Whatever, in your case, I think you need to enable ip forwarding.

sysctl -w net.ipv4.conf.all.forwarding=1

Check /etc/sysctl.conf to make it permanent

Naming interface that come into the bridge is a good idea if you want to know who is who. In the lxc config file:


network in lxc allow more sophisticated networking. For example, you could simulate a real "proxy" with 2 virtual interface, one on a bridge (say br0) connected to internet (public IPs, dmz, whatever) another (say br1) connected to the "internal services"

 | host eth0 |<----.
 '-----------'     |
         .-------------------.                  .-------------------.
         | br0 (public IP)   |                  | br1 ( |
         '-------------------'                  '-------------------'
                   ^            .--------------------.    ^
                   '------------|    guest squid     |----|
                                '--------------------'    |
                                     .---------------.    |
                                     | guest apache1 |----'
                                     '---------------'    |
                                     .---------------.    |
                                     | guest apache2 |----'
                                     '---------------'    |
                                                 | guest database |

Note: for a second virtual ethernet interface, just repeat the lxc.network... stanza


Got the same problem. I was trying to forward ports to lxc container with

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 7070 -j DNAT --to-destination

But it doesn't work. The solution was really simple:

iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE

For more details look at this

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.