Inhoud
LXC NAT Routing configuration
This document describes how to setup a NAT routing LXC Container.
Next step (optional):
More information about LXC networking:
LXC Introduction: LXC Networking scenarios
This document is based on:
- Tux4u®/Penguin Suite: PS-wheezy
- PS-app: emu-lxc 1.0.4
1. Overview
More info:
LXC Introduction: LXC Networking scenarios
2. Host network configuration
2.1 /etc/network/interfaces
- Configure a virtual bridge device
- Configure the LXC-network gateway IP-address on this bridge device
- Create the Bridge and bring it up
## /etc/network/interfaces
# LXC eth0 bridge
auto br0=br0-bridge
iface br0-bridge inet static
address 172.16.1.254
netmask 255.255.255.0
network 172.16.1.0
broadcast 172.16.1.255
bridge_ports none
bridge_fd 0
bridge_maxwait 0
- Directive “bridge_ports none” configures a bridging device without ports. (May not be omitted!)
Create the Bridge device and bring it up:
# ifup br0=br0-bridge
3. LXC Container configuration
3.1 Create new Container
3.1.1 /etc/lxc/veth-br0.conf
This config file preconfigures a new LXC Container with a Virtual Ethernet device:
lxc.network.type = veth lxc.network.flags = up lxc.network.link = br0
- The default LXC config file preconfigures a new Container with the loopback interface only.
3.1.2 Create Container
# lxc-create -n Container_name -f /etc/lxc/veth-br0.conf -t debian
- Option “-t debian” creates the container using the Debian Stable template script
3.2 Customize the Container's network configuration
The “debian” template script creates a full functional Debian system for the LXC Container.
3.2.1 LXC Container: Fixed IP-address
By default the Debian Container configures its “eth0” interface using DHCP.
Comment this out since we are using a fixed IP-address on the LXC internal
network!
- Go to “/var/lib/lxc/Container_name/rootfs/”
- Edit “etc/network/interfaces” and comment out the “eth0” lines.
- Go to “/var/lib/lxc/Container_name/”
- Edit the LXC Container “config” file and define a fixed IP-address
Detailed instructions
Edit “etc/network/interfaces” and comment out the “eth0” lines:
auto lo iface lo inet loopback ## Comment out when using a fixed IP-address # auto eth0 # iface eth0 inet dhcp
Define a fixed IP configuration in the Container's “config” file:
## /var/lib/lxc/Container_name/config lxc.network.ipv4 = 172.16.1.1/24 lxc.network.ipv4.gateway = 172.16.1.254
4. NAT and kernel routing configuration
- Please note: Commands in this section setup a live LXC NAT routing network.
- To make things permanently:
- Either put the commands in this section in a script;
- Or use firewalling software e.g. Shorewall: LXC NAT Routing Shorewall configuration
4.1 NAT Masquerading
Setup NAT Masquerading for LXC outgoing connections:
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Verify NAT configuration:
# iptables -t nat -L -v
4.2 Enable Linux kernel forwarding
# echo 1 >/proc/sys/net/ipv4/ip_forward
4.3 DNAT Port forwarding
Optionally forward service ports to a LXC Container.
E.g. forward “192.168.1.101:80” to “172.16.1.1:80”:
# iptables -t nat -A PREROUTING -p tcp -d 192.168.1.101 --dport 80 -j DNAT --to-destination 172.16.1.4:80
5. Start LXC Container
Start the Container in deamon mode (-d): 1)
# lxc-start -n Container_name -d
6. Verify LXC services
E.g. verify the webservice on “192.168.1.101” by starting a “telnet” session on port “80”:
$ telnet 192.168.1.101 80 Trying 192.168.1.101... Connected to 192.168.1.101. Escape character is '^]'.
Now issue a “GET” command to retrieve the Home page:
GET / HTTP/1.0 HTTP/1.1 200 OK Date: Mon, 18 Aug 2014 15:32:31 GMT Server: Apache/2.2.22 (Debian) Last-Modified: Wed, 30 Jul 2014 14:49:44 GMT ETag: "10cd0f-cd-4ff6a44487af4" Accept-Ranges: bytes Content-Length: 205 Vary: Accept-Encoding Connection: close Content-Type: text/html <html><body><h1>It works!</h1> </body></html> Connection closed by foreign host.
.
Copyright © 2014 Integrated Services; Tux4u.nl
Author: Marjan Waldorp; lxc/lxc-natrouting 2014-09-01
Paginahulpmiddelen
