I have two groups of lxc contianers on a server and want to isolate their network traffic for security reasons. I will be using port forwarding so the containers much each have separate IP's. I know I must subnet both groups and intend to give each a /29 Cidr. I also assume I need to put each subnet on it's own vlan.

However I'm not sure how the Veth#, bridge, vlan and host NIC need to be arranged and what options there are if any?

Ideally I would like to confine the vlans to the server alone, so that the host nic receives the forwarded packets from the router/firewall untagged. They then get tagged and untagged as they pass from the host NIC through any bridges and vlans to the Veth#s on the containers.

In short I just want to isolate each subnet from the other whilst allowing packets to be forwarded from the router to any container on each of the subnets.
If there is a simpler way I'll be glad to hear it.

P.S I'm using Ubuntu server 12.04 with it's lxc network libraries. I have not installed libvirt separately.

Any information or suggestions greatly appreciated.

  • Ok, so after a lot more digging I'm thinking of abandoning vlans and simply using bridges combined with some iptables rules to isolate them. I'm not at all sure this is the best approach but it's difficult to find any documents on this specific topic. – user108168 Nov 23 '13 at 4:24
  • Please do not cross post on the various SE sites: unix.stackexchange.com/questions/102295/… – slm Nov 23 '13 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.