Discussion:
LXD 3.0 macvlan networking
(too old to reply)
Mark Constable
2018-05-05 03:18:42 UTC
Permalink
Has something changed re networking with LXD 3.0 such that when
using a macvlan that the host CAN ping a container?

According to what I previously understood, and supported by this
comment..

https://github.com/lxc/lxd/issues/3871#issuecomment-333124249

and the main reason I hadn't bothered even trying out a macvlan
is because I need access to my local hosted containers and it
"just works" with a normal bridge. However, now when I finally
get around to testing macvlan I find I can immediately ping a
new macvlan based containers IP.

Has something changed recently regarding this macvlan restriction?

~ apt install lxd

~ lxc profile copy default macvlan (which has no eth0 device yet)

~ ip r (to get my hosts eth0 device)

~ lxc profile device add macvlan eth0 nic nictype=macvlan parent=enp4s0f1 name=eth0

~ lxc launch images:ubuntu/bionic macvlantest -p macvlan

~ lxc list --format csv
macvlantest,RUNNING,192.168.0.206 (eth0),"fdcc:3922:7dfd::6b7 (eth0)
fdcc:3922:7dfd:0:216:3eff:fe11:9335 (eth0)",PERSISTENT,0

~ ping -c1 192.168.0.206
PING 192.168.0.206 (192.168.0.206) 56(84) bytes of data.
64 bytes from 192.168.0.206: icmp_seq=1 ttl=64 time=1.98 ms


OIC, from inside the macvlantest container I can't ping the host.

But still, from this comment I would tend to assume I should not
be able to ping the container from the host either...

"@stgraber An even easier alternative to this would be using macvlan as it won't require any bridging at all, but it does come with the annoying caveat that the host will not be able to communicate with the containers."

Would anyone care to clarify this macvlan limitation please?
Janjaap Bos
2018-05-05 07:43:48 UTC
Permalink
To be able to ping a container macvlan interface, you need to have a
macvlan interface configured on the host.

Such as:

modprobe dummy
ip link set name dummy-mv dev dummy0
ip link set dev dummy-mv up
ip link add link dummy-mv mv-lxd type macvlan mode bridge
ip address add 192.168.4.1/24 dev mv-lxd
ip link set dev mv-lxd up
Post by Mark Constable
Has something changed re networking with LXD 3.0 such that when
using a macvlan that the host CAN ping a container?
According to what I previously understood, and supported by this
comment..
https://github.com/lxc/lxd/issues/3871#issuecomment-333124249
and the main reason I hadn't bothered even trying out a macvlan
is because I need access to my local hosted containers and it
"just works" with a normal bridge. However, now when I finally
get around to testing macvlan I find I can immediately ping a
new macvlan based containers IP.
Has something changed recently regarding this macvlan restriction?
~ apt install lxd
~ lxc profile copy default macvlan (which has no eth0 device yet)
~ ip r (to get my hosts eth0 device)
~ lxc profile device add macvlan eth0 nic nictype=macvlan parent=enp4s0f1 name=eth0
~ lxc launch images:ubuntu/bionic macvlantest -p macvlan
~ lxc list --format csv
macvlantest,RUNNING,192.168.0.206 (eth0),"fdcc:3922:7dfd::6b7 (eth0)
fdcc:3922:7dfd:0:216:3eff:fe11:9335 (eth0)",PERSISTENT,0
~ ping -c1 192.168.0.206
PING 192.168.0.206 (192.168.0.206) 56(84) bytes of data.
64 bytes from 192.168.0.206: icmp_seq=1 ttl=64 time=1.98 ms
OIC, from inside the macvlantest container I can't ping the host.
But still, from this comment I would tend to assume I should not
be able to ping the container from the host either...
won't require any bridging at all, but it does come with the annoying
caveat that the host will not be able to communicate with the containers."
Would anyone care to clarify this macvlan limitation please?
_______________________________________________
lxc-users mailing list
http://lists.linuxcontainers.org/listinfo/lxc-users
Mark Constable
2018-05-05 10:30:58 UTC
Permalink
Post by Janjaap Bos
To be able to ping a container macvlan interface, you need to have a
macvlan interface configured on the host.
Thank you for the host macvlan snippet but I CAN actually ping the
container from the host (but not the host from inside the container)
and that was actually my question... how come I ping the
container from my host when I just set up that container using
macvlan?
Michel Jansens
2018-05-05 18:04:48 UTC
Permalink
Well, on my system with latest install of Ubuntu 18.04 and LXD 3.0, the host can’t reach a container in macvlan setup. the container can’t connect to the host either.
on a bridged network, it works.

Michel
Post by Mark Constable
Post by Janjaap Bos
To be able to ping a container macvlan interface, you need to have a
macvlan interface configured on the host.
Thank you for the host macvlan snippet but I CAN actually ping the
container from the host (but not the host from inside the container)
and that was actually my question... how come I ping the
container from my host when I just set up that container using
macvlan?
_______________________________________________
lxc-users mailing list
http://lists.linuxcontainers.org/listinfo/lxc-users
Mark Constable
2018-05-06 00:27:38 UTC
Permalink
Post by Michel Jansens
how come I can ping the container from my host when I just set up
that container using macvlan?
Well, on my system with latest install of Ubuntu 18.04 and LXD 3.0,
the host can’t reach a container in macvlan setup. the container
can’t connect to the host either. on a bridged network, it works.
Thanks for the sanity check. That's what I thought should happen.

The only thing I can think of is that I was previously running a
bridge so my host eth device may have still been in promiscuous mode.
Andrey Repin
2018-05-06 02:12:16 UTC
Permalink
Greetings, Mark Constable!
Post by Mark Constable
Post by Janjaap Bos
To be able to ping a container macvlan interface, you need to have a
macvlan interface configured on the host.
Thank you for the host macvlan snippet but I CAN actually ping the
container from the host (but not the host from inside the container)
and that was actually my question... how come I ping the
container from my host when I just set up that container using
macvlan?
Only you can tell. Check your iptables rules/routing inside container.
--
With best regards,
Andrey Repin
Sunday, May 6, 2018 05:11:55

Sorry for my terrible english...
Continue reading on narkive:
Loading...