[Lxc-users] Setting up server in lxc container for dummies

[Dan Kegel]

Hi,
I've been happily using ubuntu's stock lxc (originally
in 12.04, now in 13.04), and finally have an occasion
to run a server inside a container. I'd like it to
be visible from the outside.

There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.

What's the simplest way to get a container to look
like just another host on the LAN, starting with
sudo apt-get install lxc
sudo lxc-create -t ubuntu -n foobar
on ubuntu 13.04?

Thanks,
Dan

[Kevin LaTona]

Hi Dan,


I've just started working with LXC so this how I am doing it and maybe some one else can fill in any areas I've left out.

If you are going to have a local LAN and outside WAN connection than you will need two ethernet cards ( 1 for each network )

Unless you already have a router setup that can punch a hole into your local network's firewall creating a DMZ connection for that container.


What I have been doing is creating a bridge on the host with a static ip.

Then each container is configured to it's own static ip address inside the container's /etc/network/interface config doc

If you check out this mailing list's archive for the last week or so you will find an example of most of my config files I used in this test.

The problem I was having is the gateway on a container was not loading .

So I ending up writing a simple Ubuntu startup script to manually load the gateway settings at the container's OS boot time.

For now it does the job until I can figure out why.


Bellow are the document paths to most config files you will need to deal with.

There are plenty of good blog post out on the web that will give you deeper details.



Finally you may want to check out this project to see it might make all the above easier for your needs. http://lxc-webpanel.github.io

I looked at it but ended up doing all manual configurations, as I wanted to better understand LXC structure for now.


Good luck.
-Kevin



Host ( create bridge )
/etc/network/interfaces


/etc/sysctl.conf
net.ipv4.ip_forward = 1


/etc/lxc/lxc.conf

/etc/default/lxc


/var/lib/lxc/containers_name/config

/var/lib/lxc/conatianers_name/rootfs/etc/network/interfaces

Post by Dan Kegel
Hi,
I've been happily using ubuntu's stock lxc (originally
in 12.04, now in 13.04), and finally have an occasion
to run a server inside a container. I'd like it to
be visible from the outside.
There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.
What's the simplest way to get a container to look
like just another host on the LAN, starting with
sudo apt-get install lxc
sudo lxc-create -t ubuntu -n foobar
on ubuntu 13.04?
Thanks,
Dan

[Kevin LaTona]

Post by Dan Kegel
There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.

I should also add that much of lxc files are created for you when creating the container as you stated earlier.

All I've been doing is tweaking these pre fab files to work in a bridged static ip mode vs dhcp mode.



In other words you are not going to have to be writing all the config files from square one.

Rather tweaking and adding a few lines here and there.


-Kevin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-users/attachments/20130731/be3e7416/attachment.html>

[Tony Su]

---------- Forwarded message ----------
From: "Tony Su" <tonysu at su-networking.com>
Date: Aug 1, 2013 8:56 AM
Subject: Re: [Lxc-users] Setting up server in lxc container for dummies
To: "Kevin LaTona" <lists at studiosola.com>
Cc:

You don't need multiple hardware NICs.
Just bind your Container network config to the same bridge device that
connects to the proper physical network and configure your IP address in
the Container if not already specified in your LXCconfig.

Assumes you're configuring static addressing and not using DHCP.

Tony

Post by Dan Kegel
There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.
I should also add that much of lxc files are created for you when creating
the container as you stated earlier.
All I've been doing is tweaking these pre fab files to work in a bridged
static ip mode vs dhcp mode.
In other words you are not going to have to be writing all the config
files from square one.
Rather tweaking and adding a few lines here and there.
-Kevin
------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-users/attachments/20130801/9368d4fb/attachment.html>

[Tony Su]

Kevin

I don't see anywhere the OP described his Host as multi-homed, much
less that the Container would be.

On general principles multiple NICs only make sense when connecting to
multiple <physical> networks, isolated from one another...

But, given the information posted, that is a very big assumption. If
nothing of the like is described, then I assume only one physical NIC
connecting to a single network which can support any number of IP
addresses and bridged devices which could in turn support any number
of virtual networks with their own addresses.

Tony

Tony,
If the container is being made available to both a public ip connection and
a private ip connection at the same time.
Would it not require either 2 NICS's that are connected to 2 different
networks.
For example one would be running on a private bridged network and the other
on a public bridged network via these different NIC cards.
Or a router using NAT to punch a hole into the local network that this
container is on?
-Kevin
---------- Forwarded message ----------
From: "Tony Su" <tonysu at su-networking.com>
Date: Aug 1, 2013 8:56 AM
Subject: Re: [Lxc-users] Setting up server in lxc container for dummies
To: "Kevin LaTona" <lists at studiosola.com>
You don't need multiple hardware NICs.
Just bind your Container network config to the same bridge device that
connects to the proper physical network and configure your IP address in the
Container if not already specified in your LXCconfig.
Assumes you're configuring static addressing and not using DHCP.
Tony

Post by Dan Kegel
There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.
I should also add that much of lxc files are created for you when creating
the container as you stated earlier.
All I've been doing is tweaking these pre fab files to work in a bridged
static ip mode vs dhcp mode.
In other words you are not going to have to be writing all the config
files from square one.
Rather tweaking and adding a few lines here and there.
-Kevin
------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

[Kevin LaTona]

Tony,

You are correct I did make an assumption about the OP.

When it mentioned wanting a container to be "visible from the outside".

I made the assumption that meant from outside of the local LAN.

Which may or may not be the end case.


-Kevin

Post by Tony Su
Kevin
I don't see anywhere the OP described his Host as multi-homed, much
less that the Container would be.
On general principles multiple NICs only make sense when connecting to
multiple <physical> networks, isolated from one another...
But, given the information posted, that is a very big assumption. If
nothing of the like is described, then I assume only one physical NIC
connecting to a single network which can support any number of IP
addresses and bridged devices which could in turn support any number
of virtual networks with their own addresses.
Tony

Tony,
If the container is being made available to both a public ip connection and
a private ip connection at the same time.
Would it not require either 2 NICS's that are connected to 2 different
networks.
For example one would be running on a private bridged network and the other
on a public bridged network via these different NIC cards.
Or a router using NAT to punch a hole into the local network that this
container is on?
-Kevin
---------- Forwarded message ----------
From: "Tony Su" <tonysu at su-networking.com>
Date: Aug 1, 2013 8:56 AM
Subject: Re: [Lxc-users] Setting up server in lxc container for dummies
To: "Kevin LaTona" <lists at studiosola.com>
You don't need multiple hardware NICs.
Just bind your Container network config to the same bridge device that
connects to the proper physical network and configure your IP address in the
Container if not already specified in your LXCconfig.
Assumes you're configuring static addressing and not using DHCP.
Tony

Post by Dan Kegel
There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.
I should also add that much of lxc files are created for you when creating
the container as you stated earlier.
All I've been doing is tweaking these pre fab files to work in a bridged
static ip mode vs dhcp mode.
In other words you are not going to have to be writing all the config
files from square one.
Rather tweaking and adding a few lines here and there.
-Kevin
------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

[Tony Su]

To be visible to outside the LAN does not require a second physical NIC,
there are a number of ways to do that binding to a single NIC.

The OP needs to post a more detailed description of his topology.

Tony

Post by Kevin LaTona
Tony,
You are correct I did make an assumption about the OP.
When it mentioned wanting a container to be "visible from the outside".
I made the assumption that meant from outside of the local LAN.
Which may or may not be the end case.
-Kevin

Post by Tony Su
Kevin
I don't see anywhere the OP described his Host as multi-homed, much
less that the Container would be.
On general principles multiple NICs only make sense when connecting to
multiple <physical> networks, isolated from one another...
But, given the information posted, that is a very big assumption. If
nothing of the like is described, then I assume only one physical NIC
connecting to a single network which can support any number of IP
addresses and bridged devices which could in turn support any number
of virtual networks with their own addresses.
Tony
On Thu, Aug 1, 2013 at 1:44 PM, Kevin LaTona <lists at studiosola.com>

Tony,
If the container is being made available to both a public ip connection

and

Post by Tony Su

a private ip connection at the same time.
Would it not require either 2 NICS's that are connected to 2 different
networks.
For example one would be running on a private bridged network and the

other

Post by Tony Su

on a public bridged network via these different NIC cards.
Or a router using NAT to punch a hole into the local network that this
container is on?
-Kevin
---------- Forwarded message ----------
From: "Tony Su" <tonysu at su-networking.com>
Date: Aug 1, 2013 8:56 AM
Subject: Re: [Lxc-users] Setting up server in lxc container for dummies
To: "Kevin LaTona" <lists at studiosola.com>
You don't need multiple hardware NICs.
Just bind your Container network config to the same bridge device that
connects to the proper physical network and configure your IP address

in the

Post by Tony Su

Container if not already specified in your LXCconfig.
Assumes you're configuring static addressing and not using DHCP.
Tony

Post by Dan Kegel
There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.
I should also add that much of lxc files are created for you when

creating

Post by Tony Su

Post by Dan Kegel
the container as you stated earlier.
All I've been doing is tweaking these pre fab files to work in a

bridged

Post by Tony Su

Post by Dan Kegel
static ip mode vs dhcp mode.
In other words you are not going to have to be writing all the config
files from square one.
Rather tweaking and adding a few lines here and there.
-Kevin

------------------------------------------------------------------------------

Post by Tony Su

Post by Dan Kegel
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.

http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk

Post by Tony Su

Post by Dan Kegel
_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

------------------------------------------------------------------------------

Post by Tony Su

Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.

http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk_______________________________________________

Post by Tony Su

Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

------------------------------------------------------------------------------

Post by Tony Su
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.

http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk

Post by Tony Su
_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-users/attachments/20130803/da220690/attachment.html>

[Dan Kegel]

Post by Tony Su
To be visible to outside the LAN does not require a second physical NIC,
there are a number of ways to do that binding to a single NIC.
The OP needs to post a more detailed description of his topology.

I have a plain old Linux box behind a plain old cable modem and consumer router.

Here's what I did:

0) installed ubuntu 13.04

1) Created a container, set it to autostart, and manually started it:
sudo lxc-create -t ubuntu -n minecraft
sudo ln -s /var/lib/lxc/minecraft/config /etc/lxc/auto/minecraft.conf
sudo lxc-start -n minecraft

2) Inside the container, installed a commandline minecraft server per
http://www.minecraftwiki.net/wiki/Tutorials/Setting_up_a_server
i.e.
$ wget https://s3.amazonaws.com/Minecraft.Download/versions/1.6.2/minecraft_server.1.6.2.jar

3) Inside the container, added a trivial upstart script per
http://www.minecraftwiki.net/wiki/Tutorials/Ubuntu_startup_script
and started it by hand with
sudo initctl start minecraft-server

4) inside the container, 'netstat -lt' showed the darn thing listened
on ipv6, not ipv4, which wasn't very helpful,
so I forced the outer system to ipv4 only by adding ipv6.disable=1 to
the kernel
commandline in /etc/default/grub per
http://www.upubuntu.com/2011/05/how-to-disable-ipv6-under-ubuntu.html
(I know, ipv6 is vital, but I'm impatient, and I doubt my ISP supports it)
Rebooted outer system, then started inner system again, and inside it,
verified that 'netstat -ltn' showed server listening on ipv4 tcp port
0.0.0.0:25565.

5) NOW paid attention to Serge's reply. Googling on it a bit found
http://www.servercobra.com/ubuntu-lxc-port-forwarding.html
which suggested doing something vaguely like

OUTERIP=192.168.AAA.BBB
INNERIP=10.0.CCC.DDD
sudo iptables -t nat -I PREROUTING -p tcp -d ${OUTERIP} --dport 25565
-j DNAT --to ${INNERIP}:25565
sudo iptables -A FORWARD -p tcp -d ${INNERIP} --dport 25565 -j ACCEPT

outside the container, where OUTERIP is the real machine's main LAN IP address,
and INNERIP is the container's IP address as seen from inside the container
(though maybe I got that wrong).

And here is where I get stuck. Although inside the container I can do
telnet localhost 25565
or
telnet 10.0.3.247 25565
and connect to the minecraft server, doing
telnet localhost 25565
or
telnet 192.168.AAA.BBB 25565
outside the container (where 192.168.AAA.BBB is my LAN ip addr)
doesn't let me connect
from the outer machine.

So here I am again, absolute beginner (having successfully ignored
learning about
iptables for longer than some people have been alive). Can I buy a clue?

Thanks!
- Dan

[Dan Kegel]

Not sure it will help. But below is my notes on how I do it on Ubuntu 12.04
and use a bridge interface for my containers.
http://heimic.net/2013/08/07/ubuntu-12-04-2-lts-and-lxc-continued/

Thanks, I may try bridging if I can't get simple port forwarding to work.

[Tony Su]

LXC Containers are configured with their own networking, so require a
bridging device like what Michael describes. If you wanted to share
networking with the Host you could setup a chroot instead.

Port(and IP) Forwarding should be enabled, but that by itself is typically
insufficient.

After you have your networking configured properly, you should then verify
your FW isn't blocking and in some cases also verify the transparent bridge
filters are disabled, typically at

/proc/sys/net/bridge

Which might all need to be set to zero, on my machine I configured in the
sysctl.conf instead of writing directly to the /proc files.

Tony

Post by Dan Kegel

Not sure it will help. But below is my notes on how I do it on Ubuntu

12.04

and use a bridge interface for my containers.
http://heimic.net/2013/08/07/ubuntu-12-04-2-lts-and-lxc-continued/

Thanks, I may try bridging if I can't get simple port forwarding to work.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-users/attachments/20130813/fe602720/attachment.html>

[Michael Fox]

Hello Dan,

Not sure it will help. But below is my notes on how I do it on Ubuntu 12.04 and use a bridge interface for my containers.

http://heimic.net/2013/08/07/ubuntu-12-04-2-lts-and-lxc-continued/

Thanks

Post by Dan Kegel

Post by Tony Su
To be visible to outside the LAN does not require a second physical NIC,
there are a number of ways to do that binding to a single NIC.
The OP needs to post a more detailed description of his topology.

I have a plain old Linux box behind a plain old cable modem and consumer router.
0) installed ubuntu 13.04
sudo lxc-create -t ubuntu -n minecraft
sudo ln -s /var/lib/lxc/minecraft/config /etc/lxc/auto/minecraft.conf
sudo lxc-start -n minecraft
2) Inside the container, installed a commandline minecraft server per
http://www.minecraftwiki.net/wiki/Tutorials/Setting_up_a_server
i.e.
$ wget https://s3.amazonaws.com/Minecraft.Download/versions/1.6.2/minecraft_server.1.6.2.jar
3) Inside the container, added a trivial upstart script per
http://www.minecraftwiki.net/wiki/Tutorials/Ubuntu_startup_script
and started it by hand with
sudo initctl start minecraft-server
4) inside the container, 'netstat -lt' showed the darn thing listened
on ipv6, not ipv4, which wasn't very helpful,
so I forced the outer system to ipv4 only by adding ipv6.disable=1 to
the kernel
commandline in /etc/default/grub per
http://www.upubuntu.com/2011/05/how-to-disable-ipv6-under-ubuntu.html
(I know, ipv6 is vital, but I'm impatient, and I doubt my ISP supports it)
Rebooted outer system, then started inner system again, and inside it,
verified that 'netstat -ltn' showed server listening on ipv4 tcp port
0.0.0.0:25565.
5) NOW paid attention to Serge's reply. Googling on it a bit found
http://www.servercobra.com/ubuntu-lxc-port-forwarding.html
which suggested doing something vaguely like
OUTERIP=192.168.AAA.BBB
INNERIP=10.0.CCC.DDD
sudo iptables -t nat -I PREROUTING -p tcp -d ${OUTERIP} --dport 25565
-j DNAT --to ${INNERIP}:25565
sudo iptables -A FORWARD -p tcp -d ${INNERIP} --dport 25565 -j ACCEPT
outside the container, where OUTERIP is the real machine's main LAN IP address,
and INNERIP is the container's IP address as seen from inside the container
(though maybe I got that wrong).
And here is where I get stuck. Although inside the container I can do
telnet localhost 25565
or
telnet 10.0.3.247 25565
and connect to the minecraft server, doing
telnet localhost 25565
or
telnet 192.168.AAA.BBB 25565
outside the container (where 192.168.AAA.BBB is my LAN ip addr)
doesn't let me connect
from the outer machine.
So here I am again, absolute beginner (having successfully ignored
learning about
iptables for longer than some people have been alive). Can I buy a clue?
Thanks!
- Dan
------------------------------------------------------------------------------
Get 100% visibility into Java/.NET code with AppDynamics Lite!
It's a free troubleshooting tool designed for production.
Get down to code-level detail for bottlenecks, with <2% overhead.
Download for free and get started troubleshooting in minutes.
http://pubads.g.doubleclick.net/gampad/clk?id=48897031&iu=/4140/ostg.clktrk
_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-users/attachments/20130813/30255b71/attachment.html>

[Serge Hallyn]

Post by Dan Kegel

Post by Tony Su
To be visible to outside the LAN does not require a second physical NIC,
there are a number of ways to do that binding to a single NIC.
The OP needs to post a more detailed description of his topology.

I have a plain old Linux box behind a plain old cable modem and consumer router.
0) installed ubuntu 13.04
sudo lxc-create -t ubuntu -n minecraft
sudo ln -s /var/lib/lxc/minecraft/config /etc/lxc/auto/minecraft.conf
sudo lxc-start -n minecraft
2) Inside the container, installed a commandline minecraft server per
http://www.minecraftwiki.net/wiki/Tutorials/Setting_up_a_server
i.e.
$ wget https://s3.amazonaws.com/Minecraft.Download/versions/1.6.2/minecraft_server.1.6.2.jar
3) Inside the container, added a trivial upstart script per
http://www.minecraftwiki.net/wiki/Tutorials/Ubuntu_startup_script
and started it by hand with
sudo initctl start minecraft-server
4) inside the container, 'netstat -lt' showed the darn thing listened
on ipv6, not ipv4, which wasn't very helpful,
so I forced the outer system to ipv4 only by adding ipv6.disable=1 to
the kernel
commandline in /etc/default/grub per
http://www.upubuntu.com/2011/05/how-to-disable-ipv6-under-ubuntu.html
(I know, ipv6 is vital, but I'm impatient, and I doubt my ISP supports it)
Rebooted outer system, then started inner system again, and inside it,
verified that 'netstat -ltn' showed server listening on ipv4 tcp port
0.0.0.0:25565.
5) NOW paid attention to Serge's reply. Googling on it a bit found
http://www.servercobra.com/ubuntu-lxc-port-forwarding.html
which suggested doing something vaguely like
OUTERIP=192.168.AAA.BBB
INNERIP=10.0.CCC.DDD
sudo iptables -t nat -I PREROUTING -p tcp -d ${OUTERIP} --dport 25565
-j DNAT --to ${INNERIP}:25565
sudo iptables -A FORWARD -p tcp -d ${INNERIP} --dport 25565 -j ACCEPT

For a container, with ip 10.0.3.100, running a mail server on port 25,
the only rule I add is:

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25 -j DNAT --to-destination 10.0.3.100:25

(plus of course several other rules for other containers)

-serge

[Dan Kegel]

Post by Serge Hallyn
For a container, with ip 10.0.3.100, running a mail server on port 25,
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25 -j DNAT --to-destination 10.0.3.100:25

That works, thanks. But it only works as observed from other boxes
on the LAN. What would I have to do to also be able to connect to
the lxc guest service from the lxc host?

[Serge Hallyn]

Post by Dan Kegel

Post by Serge Hallyn
For a container, with ip 10.0.3.100, running a mail server on port 25,
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25 -j DNAT --to-destination 10.0.3.100:25

That works, thanks. But it only works as observed from other boxes
on the LAN. What would I have to do to also be able to connect to
the lxc guest service from the lxc host?

Heh, I've never noticed that. I always go to 'container.lxc' if i'm on
the host. I suspect you could add a rule for -i lo?

[Kevin LaTona]

Can any one point me towards a good source(s) of information about using multi bridges with LXC's if that is even possible or suggested yet?

I came across a Proxmox document that stated a host is capable of 4094 bridges. http://pve.proxmox.com/wiki/Network_Model

Yet I've not found much about theses kind of set ups under LXC's so far.

Thanks
-Kevin

one physical NIC connecting to a single network which can support any number of IP
addresses and bridged devices which could in turn support any number of virtual networks with their own addresses.

[Fajar A. Nugraha]

Post by Kevin LaTona
Can any one point me towards a good source(s) of information about using
multi bridges with LXC's if that is even possible or suggested yet?

It's pretty much straight forward. Create a bridge, then use it in lxc
config file.

Post by Kevin LaTona
I came across a Proxmox document that stated a host is capable of 4094
bridges. http://pve.proxmox.com/wiki/Network_Model
Yet I've not found much about theses kind of set ups under LXC's so far.

Most of the information there (i.e. about bonding and vlan) should apply to
lxc as well. If there's a limit on number of bridges, it would be linux
limit.

Here's an example of bridging with vlan and bonding for xen, for
comparison: http://et.redhat.com/~jmh/docs/Xen_networking.pdf

[Leonid Isaev]

On Wed, 31 Jul 2013 20:24:42 -0700

Post by Dan Kegel
Hi,
I've been happily using ubuntu's stock lxc (originally
in 12.04, now in 13.04), and finally have an occasion
to run a server inside a container. I'd like it to
be visible from the outside.
There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.
What's the simplest way to get a container to look
like just another host on the LAN, starting with
sudo apt-get install lxc
sudo lxc-create -t ubuntu -n foobar
on ubuntu 13.04?

To keep things simple, let's for now distinguish the following 2 scenarios: (1)
LXC host is just another machine on the LAN, i.e. it can get IP from a DHCP
server or has a static IP, but is not a gateway for other real machines; (2)
LXC host is a gateway/router for the LAN.

Please note that I only used LXC on non-debian systemd-based distros, so I can
tell you in detail how to do the following using systemd services, but not
upstart. Also, I have no idea about ubuntu filesystem structure.

Scenario (1)
------------
Let's assume that the host interface is "eth_host". TL;DR: you have to turn
your host into a switch.

* Stop and disable all networking on the host, i.e. eth_host has no IP.
* Create a bridge on the host, e.g. "br0", add "eth_host" to it, and make
sure that your LXC configuration is aware of this bridge (for a default
configuration you should have lxc.network.type=veth and lxc.network.link=br0
in the container config). This bridge has to be enabled on boot, so write an
init (or upstart job) file (ubuntu probably has some templates for this).
* Enable networking on the bridge "br0", not "eth_host". This means that "br0"
will get an IP in the same way "eth_host" did. Modify your networking files
accordingly.
* Start containers and configure their networking. For example, if the host
uses DHCP, use DHCP inside the containers as well.

Your host and containers will now look identical for other machines on the
LAN. For example in case of DHCP, they will all get IPs from the server. Make
sure that you protect the containers with a firewall.

Scenario (2)
------------
Let's assume that the gateway has 2 interfaces "eth_lan" and "eth_wan" for the
LAN and WAN respectively, and you want to run several containers on this
gateway. Typically there is a DHCP server listening on "eth_lan" which itself
has a static IP. Your goal is achieved using similar steps as in the previous
case: again create a bridge "br0", add "eth_lan" to it, give "br0" the static
IP that "eth_lan" had, and tell DHCP server to listen on "br0". Then, proceed
as in Scenario (1). Now containers will appear as real hosts on the LAN.

HTH,
Leonid.

Post by Dan Kegel
Thanks,
Dan
------------------------------------------------------------------------------
Get your SQL database under version control now!
Version control is standard for application code, but databases havent
caught up. So what steps can you take to put your SQL databases under
version control? Why should you start doing it? Read more to find out.
http://pubads.g.doubleclick.net/gampad/clk?id=49501711&iu=/4140/ostg.clktrk
_______________________________________________
Lxc-users mailing list
Lxc-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users

--
Leonid Isaev
GnuPG key: 0x164B5A6D
Fingerprint: C0DF 20D0 C075 C3F1 E1BE 775A A7AE F6CB 164B 5A6D
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-users/attachments/20130801/35b8f871/attachment.pgp>

[Serge Hallyn]

Post by Dan Kegel
Hi,
I've been happily using ubuntu's stock lxc (originally
in 12.04, now in 13.04), and finally have an occasion
to run a server inside a container. I'd like it to
be visible from the outside.
There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.
What's the simplest way to get a container to look
like just another host on the LAN, starting with
sudo apt-get install lxc
sudo lxc-create -t ubuntu -n foobar
on ubuntu 13.04?

Besides having multiple nics or bridging the container with the host's
eth0, you can also simply forward the ports you want to the container.
If only one container will use a given port on the machine then you can
forward port X on eth0 to port X on the 10.0.3.$(container), else you
can use custom ports.

(Or use ipv6 :)

-serge

[TuxRaiderPen]

Post by Dan Kegel
Hi,
I've been happily using ubuntu's stock lxc (originally
in 12.04, now in 13.04), and finally have an occasion
to run a server inside a container. I'd like it to
be visible from the outside.
There are plenty of web pages about this, but they seem to
assume that you've created the lxc config file by hand.
I have never done that; I just use whatever lxc-create creates.

Ok... sounds like you might be in a situation I am in/was in..

I use LXC to test a few things... and mainly as a "development system(s)" for
web servers

ie: I assign a LXC container to each client... may not be the best from a lot
of perspectives, but for me it allows for a certain sanity and order of
things...

I like you just let LXC create things.

Kubuntu derived custom distro based on 12.04 LTR & lxc 0.7.5

I needed a way for clients to look at "their server" and check progress of
development....

Simple solution in *SOME* of the standard routers LinkSys, Netgear etc. is
just set up a static route for the 10.x.x.x subnet that your LXC containers
are on to point to the bridge host

example:

If your LXC-HOST is: 192.168.0.10 and your LXC subnet is 10.0.3.x and your LXC
lxcbr0 = 10.0.3.1

then setup a static route in your router

to send all of 10.0.3/24 to 10.0.3.1 and then let the LXC host forward on...

You can forward ports for things like Apache, MySQL etc... or what ever to
10.0.3.IP and again the lxcbr figures out and forwards it on....

That worked great till I upgraded my router to a newer model and then this new
router ONLY ALLOWS for the forwarded IP to be WITHIN THE /24 of the LAN...
URRRRRGRGGGHHH! In some stroke of brilliance or "bug resolution" they closed
this "loophole/feature (bug)."

So What to do? ? ?

I changed the static route to forward to the LXC-HOST IP ie: 192.168.0.10 and
then the LXC-HOST figures out to route 10.0.3.x to what ever LXC container...

That works great for INTERNAL connections... BUT when clients wanted to review
development... how to get the port forwarded for say Apache to their
container? ?

Forwarding port 80 to the LAN IP of the LXC HOST will NOT work it...

Enter

rinetd

It basically can forward IP/PORT to NEWIP/PORT ie:

192.168.0.11 80 10.0.3.200 80

So I " sudo apt-get install rinetd " on a machine that has nothing special
running on it... It probably could even go on the LXC-HOST.. but I chose NOT
to do this so as not to risk FUBAR'ng the LXC host and its routing etc....

So the rinted machine is 192.168.0.11 and then setup the router to forward
port 80 to 192.168.0.11 and then rinetd forwards this to the LXC container of
my choice.

This solves the problem... Client can remotely view their server progress, I
can connect to the containers internally, I can connect remotely.

Cisco IOS based routers could set up routing much easier as IOS is much more
powerful and doesn't restrict the destination IP like newer routers.

Something like:

ip nat inside source static tcp 10.0.3.2 80 WAN IP 80 extendable
ip nat inside source static tcp 10.0.3.2 443 WAN IP 443 extendable
ip nat inside source static tcp 10.0.3.2 3306 WAN IP 3306 extendable

etc...

And routing like the older router

ip route 10.10.3.0 255.255.255.0 10.10.3.1

Or what ever your LXC setup is

ip route LXC-SUBNET NETMASK LXCBR0 IP


Again, I chose this route v. changing any LXC container setups from what was
generated... Mainly as too new at the time I devised this plan to LXC.. I come
from a world of VMWare Server, ESXi and Player VM's and getting the VM's on
the LAN works differently in "VMWARE BRIDGE" v. LXC BRIDGE. WAY DIFFERENT. In
that in VMWare Bridge the VM/Container gets an IP from the LAN and from its
DHCP etc. just like it was a real physical machine on the LAN.. Now I am sure
there probably is some way to edit the LXC container configs to do this... but
in reading this thread and somethings it doesn't seem like this is supported
or wise... That is MY OPINION and INTERPRETATION, subject to being totally
wrong. I have a setup that works for the resources I have till I find a nice
used Cisco device that meets my needs....

[Rob Landley]

On Tue, Aug 13, 2013 at 7:11 AM, Serge Hallyn

Post by Serge Hallyn
For a container, with ip 10.0.3.100, running a mail server on port

25,

Post by Serge Hallyn
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25 -j DNAT

--to-destination 10.0.3.100:25
That works, thanks. But it only works as observed from other boxes
on the LAN. What would I have to do to also be able to connect to
the lxc guest service from the lxc host?

Here:

http://dvpn.sourceforge.net/old/firewall-rules.txt

That's the firewall ruleset I did a decade ago for setting up a cheesy
VPN that forwarded all connections for an address range to a daemon
running on loopback that would look up the original destination
(getsockopt(SO_ORIGINAL_DEST)), figure out which server handled that
subset of the address range (comments in /etc/hosts acted as a VPN
config file), ssh there, and run netcat to complete the connection.

I had to use source NAT _and_ destination NAT, for both local
connections and remote connections, in order to make that work. I still
find it a handy cheat sheet for beating iptables into submission...

Rob

[Dan Kegel]

Rob,
thanks, I might learn something from that file.

I suspect that the path forward for me is to do
what I always do with semi-documented complex
systems (e.g. cmake): write the smallest possible
examples (using, say, netcat) and fiddle with them until they work.
- Dan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxcontainers.org/pipermail/lxc-users/attachments/20130815/42e8df62/attachment.html>