how to assign a public IP address to a LXC instance?

4n0nx

Hi,

I am trying to assign a failover IP address to a LXC instance. I have done the following on Ubuntu 14.04:

apt-get install lxc bridge-utils

lxc-create -t download -n u1 -- --dist ubuntu --release trusty --arch amd64

nano /etc/network/interfaces
add the following:

auto br1
iface br1 inet static
        address my.fail.over.ip
        netmask 255.255.255.0
        bridge_ports none
        bridge_stp off
        bridge_fd 0


ifup br1


nano /var/lib/lxc/u1/config

change to:

lxc.network.link = br1
lxc.network.hwaddr = 52:xx:xx:xx:xx:xx # (virtual MAC generated by provider)


lxc-start -n u1 -d

The container then has no network connection. I have never set up a bridge and am clueless. What do I need to do? Thanks.

William

uh, yes, of course? How should the bridge work if you do not bridge any interfaces into it...?

4n0nx

William said: uh, yes, of course? How should the bridge work if you do not bridge any interfaces into it...?

Now it makes sense to me why all the examples contained "bridge_ports eth0". However, whenever I put "bridge_ports em0" (my interface is named em0 for some reason..) and type in "ifup br1", the network connection breaks and I have to reinstall the server.

Is that what I am supposed to do? If yes, why won't it work?

scy

If your config on the host is functional, you can set up the failover IP directly in the conf of your LXC container:

lxc.network.ipv4 = 192.168.0.101/24  #change with your failover IP
lxc.network.ipv4.gateway = 192.168.0.1 #change that with the gateway on the network

then in containers network config file (/var/lib/lxc/containername/rootfs/etc/network/interfaces) :

auto eth0
iface eth0 inet static
    address 192.168.0.101 #change with your failover IP

If you didn't have it working with local IP, I'd advise first to experiment that way.
Debian doc isn't too bad on the subject, and there are different tutotials available online. There is different ways to get the network inside the container. Depending what you want to achieve, one way could be better than another. Veth should work out of the box.

(https://feeding.cloud.geek.nz/posts/lxc-setup-on-debian-jessie/)

I'd advise you not to start with a failover IP, just give a local IP to your container and NAT to/from your server IP. Then once this works you can play with another IP.

Have fun

scy

I didn't exactly what you wanted to do, if it's giving a failover IP to a container or getting your container to reach the internet configuring your host (the bare metal server) correctly for that. In the second case:

auto br0
iface br0 inet static
    address XX.XX.XX.XX #your IP
    netmask 255.255.255.0
    gateway XX.XX.XX.XX # gateway IP  
    bridge_ports eth0 #change with iface name

if you need to get traffic from local ip within the container to the internets:

auto br0:1
iface br0:1 inet static
    address 192.168.0.1 #then this will be your gateway
up ip route add 192.168.0.0/16 dev br0 

4n0nx

scy said: bridge_ports eth0 #change with iface name

When I add that line (replace eth0 with em0, which is my iface name), the connection to my server breaks after typing in "ifup br0".

scy said: I'd advise you not to start with a failover IP, just give a local IP to your container and NAT to/from your server IP. Then once this works you can play with another IP.

It works out of the box with NAT using the host IP. I want to give each container a different IP address.

scy said: If your config on the host is functional,

What does that mean? I have a fresh OS.

scy

So you have two IP: server IP and failover IP, right?

If so you have to KEEP the server IP as it is now if you use it to connect to the server via SSH. You don't need your failover IP to be a bridge if you want to use it only in ONE container. Just give this IP address to the container, on it's config file, like in the example in my first answer.

William

4n0nx said: Now it makes sense to me why all the examples contained "bridge_ports eth0". However, whenever I put "bridge_ports em0" (my interface is named em0 for some reason..) and type in "ifup br1", the network connection breaks and I have to reinstall the server.

em0 is normal for Ubuntu 13+.

You need to remove the config for em0 from network/interfaces and set it like this:

auto em0
iface em0 inet manual

Then configure a bridge like this:

auto br1
iface br1 inet static
        address main.server.ip
        netmask 255.255.255.0
        bridge_ports em0
        bridge_stp off
        bridge_fd 0

Then reboot.

You have to reinstall because your em0/br1 settings conflict, this fixes that.

4n0nx

scy said: If so you have to KEEP the server IP as it is now if you use it to connect to the server via SSH. You don't need your failover IP to be a bridge if you want to use it only in ONE container. Just give this IP address to the container, on it's config file, like in the example in my first answer.

I just tried that (exactly like you wrote) and it does not work. eth0 is simply missing in the container

4n0nx

William said: You need to remove the config for em0 from network/interfaces and set it like this:

I just did that (fresh install, apt-get install lxc bridge-utils, your settings, reboot) and my server is unreachable.

4n0nx

I was just going to resort to Proxmox with LXC.. but it does not work either I install Proxmox, create a bridge over the panel with failover IP, netmask and gateway, create a CT that uses the bridge.. no connection. No eth0 in container, just lo.

scy

But you said it worked out of the box with nat. In that case, you get an eth0 in the container, with a local network IP, isn't it?

4n0nx

@scy @william

I had it working the entire time, if it had not been for:

• DNS in containers was broken and I must have sometimes not pinged an IP, only a host. facepalms
• random server reboots after installation, maybe I did not wait long enough before connecting
• Proxmox. I don't get it: It works when I apt-get install lxc but not when I use Proxmox and provide exactly the same information.
• going out of my way to try settings that make no sense (and especially trying Proxmox)
• not taking a break for many hours (errors probably happened)

one of these things was always the cause and I still have no clue why it won't work with Proxmox. The container appears to be configured correctly (eth0 visible with correct IP), the bridge is set up the way it works with manual setup, yet there is no network connection in the container.

Luckily I prefer manual setup anyway.

Now I am going to try and add IPv6 to the containers, which I plan to do by setting up dhclient6 (online.net server), adding the IPv6 to my bridge and then changing the LXC config file as well as the container interfaces file.

Sounds easy and like it should work, but I just know I am going to need help...

scy

Glad to hear that you get it sorted

Regarding IPv6 I didn't succeed yet, but didn't try to much. I plan to experiment more with it on a clean setup with FDE, in a few days. If you get it working in the meantime, please share with us the way you used!

4n0nx

scy said: Glad to hear that you get it sorted

Regarding IPv6 I didn't succeed yet, but didn't try to much. I plan to experiment more with it on a clean setup with FDE, in a few days. If you get it working in the meantime, please share with us the way you used!

I managed to set up IPv6 on my online.net dedi, but not yet to add it to a bridge.

http://documentation.online.net/fr/serveur-dedie/reseau/prefixe_ipv6#configuration_alternative_avec_dhclient (I simply added the dhclien6.conf and like 4 lines to my interfaces, reboot, done.)

I think it was you who posted this in another thread: https://blog.bandinelli.net/index.php?post/2013/11/10/Installation-et-paramétrage-d-une-serveur-avec-containers-LXC-chez-Online.net/Dedibox

It will probably be helpful

scy

I got it working on the dedi but not in the LXC jails yet. Didn't try more, but will in a few days. The second link seems interesting, indeed

4n0nx

It's ridiculous how much shit gets in your way. Apparently it is not possible to restart interfaces with service networking restart anymore (on Ubuntu 14.04).

ifdown br0 && ifup br0 does not work (connection dies before it can start br0), instead a bash script is needed. Are there any other ways?

4n0nx

I created a bridge vmbr0 on a freshly installed Ubuntu 14.04 to which I added the host IPv4 and a /56. I used dhclient, in case that is important. IPv4 and IPv6 work fine on the host node.

IPv4 (failover) as well as NAT IPv4 work fine in the LXC instance.

IPv6 does not work in the LXC instance. ifconfig shows a local IPv6 /64 and I can't get it to use part of the /56 assigned to the bridge on the host node.

Container config:

lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = vmbr0
lxc.network.ipv4 = 192.168.0.101/24
lxc.network.ipv4.gateway = 192.168.0.1 # local IP added to vmbr0 for NAT
lxc.network.hwaddr = 00:16:3e:f3:xx:xx
lxc.network.ipv6 = 2001:bc8:xxxx:xxx::101/56
lxc.network.ipv6.gateway = 2001:bc8:xxxx:xxx::1 # IPv6 of vmbr0

Container interfaces:

auto eth0
iface eth0 inet static
   address 192.168.0.101

iface eth0 inet6 static
    address 2001:bc8:xxxx:xxx::101
     netmask 56
     post-up ip -6 route add default via 2001:bc8:xxxx:xxx::1

In sysctl I have set

net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.accept_ra = 2

on host node I further did:

ip -6 route add 2001:bc8:xxxx:xxx::101 dev vmbr0

I followed this how-to rather closely and I can't figure out what I am missing: https://blog.bandinelli.net/index.php?post/2013/11/10/Installation-et-paramétrage-d-une-serveur-avec-containers-LXC-chez-Online.net/Dedibox