I have two groups of lxc contianers on a server and want to isolate their network traffic for security reasons. I will be using port forwarding so the containers much each have separate IP's. I know I must subnet both groups and intend to give each a /29 Cidr. I also assume I need to put each subnet on it's own vlan.
However I'm not sure how the Veth#, bridge, vlan and host NIC need to be arranged and what options there are if any?
Ideally I would like to confine the vlans to the server alone, so that the host nic receives the forwarded packets from the router/firewall untagged. They then get tagged and untagged as they pass from the host NIC through any bridges and vlans to the Veth#s on the containers.
In short I just want to isolate each subnet from the other whilst allowing packets to be forwarded from the router to any container on each of the subnets.
If there is a simpler way I'll be glad to hear it.
P.S I'm using Ubuntu server 12.04 with it's lxc network libraries. I have not installed libvirt separately.
Any information or suggestions greatly appreciated.