LXC NAT Routing configuration

This document describes how to setup a NAT routing LXC Container.

Next step (optional):

More information about LXC networking:
LXC Introduction: LXC Networking scenarios

This document is based on:
- Tux4u®/Penguin Suite: PS-wheezy
- PS-app: emu-lxc 1.0.4

1. Overview

2. Host network configuration

2.1 /etc/network/interfaces

  1. Configure a virtual bridge device
  2. Configure the LXC-network gateway IP-address on this bridge device
  3. Create the Bridge and bring it up
## /etc/network/interfaces

# LXC eth0 bridge
auto br0=br0-bridge
iface br0-bridge inet static
        bridge_ports none
        bridge_fd 0
        bridge_maxwait 0
  • Directive “bridge_ports none” configures a bridging device without ports. (May not be omitted!)

Create the Bridge device and bring it up:

# ifup br0=br0-bridge

3. LXC Container configuration

3.1 Create new Container

3.1.1 /etc/lxc/veth-br0.conf

This config file preconfigures a new LXC Container with a Virtual Ethernet device: = veth = up = br0
  • The default LXC config file preconfigures a new Container with the loopback interface only.

3.1.2 Create Container

# lxc-create -n Container_name -f /etc/lxc/veth-br0.conf -t debian
  • Option “-t debian” creates the container using the Debian Stable template script

3.2 Customize the Container's network configuration

The “debian” template script creates a full functional Debian system for the LXC Container.

3.2.1 LXC Container: Fixed IP-address

By default the Debian Container configures its “eth0” interface using DHCP.
Comment this out since we are using a fixed IP-address on the LXC internal network!

  1. Go to “/var/lib/lxc/Container_name/rootfs/”
  2. Edit “etc/network/interfaces” and comment out the “eth0” lines.
  3. Go to “/var/lib/lxc/Container_name/”
  4. Edit the LXC Container “config” file and define a fixed IP-address
Detailed instructions

Edit “etc/network/interfaces” and comment out the “eth0” lines:

auto lo
iface lo inet loopback

## Comment out when using a fixed IP-address
# auto eth0
# iface eth0 inet dhcp

Define a fixed IP configuration in the Container's “config” file:

## /var/lib/lxc/Container_name/config = =

4. NAT and kernel routing configuration

  • Please note: Commands in this section setup a live LXC NAT routing network.
  • To make things permanently:

4.1 NAT Masquerading

Setup NAT Masquerading for LXC outgoing connections:

# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Verify NAT configuration:

# iptables -t nat -L -v

4.2 Enable Linux kernel forwarding

# echo 1 >/proc/sys/net/ipv4/ip_forward

4.3 DNAT Port forwarding

Optionally forward service ports to a LXC Container.

E.g. forward “” to “”:

# iptables -t nat -A PREROUTING -p tcp -d --dport 80 -j DNAT --to-destination

5. Start LXC Container

Start the Container in deamon mode (-d): 1)

# lxc-start -n Container_name -d

6. Verify LXC services

E.g. verify the webservice on “” by starting a “telnet” session on port “80”:

$ telnet 80

Connected to
Escape character is '^]'.

Now issue a “GET” command to retrieve the Home page:

GET / HTTP/1.0

HTTP/1.1 200 OK
Date: Mon, 18 Aug 2014 15:32:31 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Wed, 30 Jul 2014 14:49:44 GMT
ETag: "10cd0f-cd-4ff6a44487af4"
Accept-Ranges: bytes
Content-Length: 205
Vary: Accept-Encoding
Connection: close
Content-Type: text/html

<html><body><h1>It works!</h1>
Connection closed by foreign host.


Copyright © 2014 Integrated Services;
Author: Marjan Waldorp; lxc/lxc-natrouting 2014-09-01

Omitting option “-d” will connect your terminal to the console of the running Container.
linux/applicaties/lxc/lxc-natrouting.txt · Laatst gewijzigd: 2018/12/30 17:17 (Externe bewerking)