0

I've configured an lxc container with softether. The lxc container has a bridge connection, so I have a LAN IP with my lxc container.

Here's the IPs of my office:

  • Router/DHCP Server: 192.168.1.1

  • LXC Host: br0 - 192.168.1.2

  • LXC Guest: 192.168.1.3

  • DHCP Range: 192.168.1.200-192.168.1.220

LXC Guest is accessible from lan

Now I want to use softeher to enable access to LAN with LAN ip, so I want that any client that connects gets the an IP from the LAN DHCP.

For example, vpn user ip: 192.168.1.200

I've tried to configure bridged IP within LXC guest but I can't get working.

Here is the config of the lxc guest:

# Template used to create this container: /usr/share/lxc/templates/lxc-debian
# Parameters passed to the template: -r jessie
# For additional config options, please look at lxc.container.conf(5)
lxc.network.type = veth
lxc.rootfs = /var/lib/lxc/debvpn/rootfs
lxc.network.link = br0

# Common configuration
lxc.include = /usr/share/lxc/config/debian.common.conf

# Container specific configuration
lxc.mount = /var/lib/lxc/debvpn/fstab
lxc.utsname = debvpn
lxc.arch = amd64
lxc.autodev = 1
lxc.kmsg = 0


lxc.network.flags = up
lxc.network.ipv4 = 192.168.1.3/24
lxc.network.ipv4.gateway = 192.168.1.1
lxc.cgroup.memory.limit_in_bytes = 1024M
lxc.network.link = br0
lxc.network.hwaddr = 00:FF:EA:14:24:13

lxc.cgroup.devices.deny = a

lxc.cgroup.devices.allow = c 10:200 rwm

lxc.hook.autodev = sh -c "modprobe tun; cd ${LXC_ROOTFS_MOUNT}/dev; mkdir net; mknod net/tun c 10 200; chmod 0666 net/tun"

And the /etc/network/interfaces of the lxc guest: iface lo inet loopback

iface eth0 inet manual

iface br0 inet static
  bridge-ifaces   eth0
  bridge_ports    eth0
  bridge_stp      off
  bridge_fd       9
  bridge_hello 2
  bridge_maxage 12
  up ifconfig eth0 up

Any help on create the bridged network within an lxc container?

Thanks in advance, choldi

  • 1
    Does the bridge exist in the guest? Do you get any permissions errors on the host / guest in syslog? Since LXC uses a network namespace, it seems to me that it should work out of the box. If not, you may need CAP_NET_ADMIN capabilities. You can grant this capability with cgroups – BobTuckerman Aug 2 '16 at 4:21
  • I don't get any error on syslogs (on host and guest). I'm not sure how works network namespaces, but the guest runs in a privileged namespace. Any lecture about network namespaces and capability management would be appretiate. – choldi Aug 3 '16 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.