Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #208687

LXC, networking and firewalling

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi all,

I have a couple of VPSes (Xen and KVM based), in which I run LXC containers.

Currently I have a bridge device set up on the host (not bridged to the
external network), and iptables to do firewalling and NAT as required.

Here's my bridge setup, if that helps:

---------------8<------------
auto br0
iface br0 inet static
 bridge_ports none
 bridge_fd 0
 bridge_maxwait 0
 address 192.168.123.1
 netmask 255.255.255.0

iface br0 inet6 static
  address fd49:5bcf:0bed:5d9c::1/64
---------------8<------------

What I think doesn't work so well is attempting to filter traffic either
between containers, or between a container and the host.

Also, ISTR people saying iptables shouldn't be used on a bridge at all.

So before I set up my next VPS (and possibly reconfigure my older
one(s)), is there a better way I should be considering?

Do I need to use ebtables on the bridge? Will that work between containers?

Would I be better off using multiple bridges?

As an aside, if I get access to VLANs from my provider (I don't think
I've ever (successfully) configured VLANs on Linux before), I assume I
can include a VLAN in each bridge, and I guess leave the default one out?

Thanks,
Richard

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

LXC, networking and firewalling Richard Hector <richard@walnut.gen.nz> - 2019-05-16 03:30 +0200
  Re: LXC, networking and firewalling Reco <recoverym4n@enotuniq.net> - 2019-05-16 07:50 +0200

csiph-web