Home / server / Questions / 258416
In Process
SledgehammerPL
Asked: 2011-04-12 09:56:29 +0800 CST

veth, macvlan or maybe sth else?

  • 772

I don't understand the modes of lxc network.

I'd like to have 4 guests: apache1, apache2, database and frontdoor

frontdoor is a squid which decides which apache should be used

It works perfectly on vservers, when all of guests has a dummy interface (isolated from web) and frontdoor has two interfaces real eth0 and dummy

Now I migrate to lxc, and instead of dummy I use bridge (on host) and mode=veth (on guests)

I'm not happy seeing four vethLIJG3f in ifconfig, but let's see its ok.

the problem is, that I CAN'T get to squid. I'm trying to iptables -t NAT -A PREROUTING -p tcp --dport 80 -j DNAT --to-dest 172.16.0.2 but it simply doesn't work.

I wonder if I should change veth to something else?

debian network-share lxc

2 Answers

  1. Well this interesting, I'm playing with a vserver and I do not really understand how it works with eth and dummy.

    Whatever, in your case, I think you need to enable ip forwarding.

    sysctl -w net.ipv4.conf.all.forwarding=1

    Check /etc/sysctl.conf to make it permanent

    Naming interface that come into the bridge is a good idea if you want to know who is who. In the lxc config file:

    lxc.network.veth.pair=eth0-guest1

    network in lxc allow more sophisticated networking. For example, you could simulate a real "proxy" with 2 virtual interface, one on a bridge (say br0) connected to internet (public IPs, dmz, whatever) another (say br1) connected to the "internal services"

     .-----------.
 | host eth0 |<----.
 '-----------'     |
         .-------------------.                  .-------------------.
         | br0 (public IP)   |                  | br1 (10.1.1.1/24) |
         '-------------------'                  '-------------------'
                   ^            .--------------------.    ^
                   '------------|    guest squid     |----|
                                '--------------------'    |
                                     .---------------.    |
                                     | guest apache1 |----'
                                     '---------------'    |
                                     .---------------.    |
                                     | guest apache2 |----'
                                     '---------------'    |
                                                 .----------------.
                                                 | guest database |
                                                 '----------------'

    Note: for a second virtual ethernet interface, just repeat the lxc.network... stanza

    • 2

  2. Got the same problem. I was trying to forward ports to lxc container with

    iptables -t nat -A PREROUTING -p tcp -m tcp --dport 7070 -j DNAT --to-destination 172.16.110.15:7070

    But it doesn't work. The solution was really simple:

    iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE

    For more details look at this

    • 2