[SOLVED] No internet access for a container

[Sophie_Moreira]

Hi guys,

I am new to proxmox and quite a newbie in netwowrking though I know a little bit about linux command.

I have a proxmox host on an OVH server. I have created a ubuntu CT container with the following configuration.



Configuration of the container :



If my understanding is correct the container should be able to ping internet now. From the container I can ping the gateway :

ping 10.0.0.0
PING 10.0.0.0 (10.0.0.0) 56(84) bytes of data.
64 bytes from 10.0.0.0: icmp_seq=1 ttl=64 time=0.120 ms
64 bytes from 10.0.0.0: icmp_seq=2 ttl=64 time=0.085 ms

and the public ip of the host :

ping 5.39.90.204
PING 5.39.90.204 (5.39.90.204) 56(84) bytes of data.
64 bytes from 5.39.90.204: icmp_seq=1 ttl=64 time=0.106 ms
64 bytes from 5.39.90.204: icmp_seq=2 ttl=64 time=0.107 ms

but not internet :

ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 4090ms

Could you please help me to debug that ? many thx

 

[Dunuin]

Did you set up a router on 10.0.0.0 that will route between your local subnet and the internet?
Like turning your PVE host into a router?: https://pve.proxmox.com/wiki/Network_Configuration#sysadmin_network_masquerading

 

[Sophie_Moreira]

Hi Dunuin,

thank you for your answer, no I did not up.

I updated /etc/network/interfaces in the host like that :

post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.0.0.0/24' -o eno1 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/24' -o eno1 -j MASQUERADE

It still does not work .

 

[Dunuin]

Your NIC is called eno0 and not eno1. And don't forget rebooting.

 

[Sophie_Moreira]

Thx again Dunuin, but I still can't ping from the container.




I have rebooted both host and the container and also tried to add those lines :

post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

it still does not work...

 

[Dunuin]

Try to stick to the example from the wiki. There the NIC got the public IP and gateway and not the bridge.

 

[Sophie_Moreira]

ok thanks,

I am very new to networking. so in the iptables lines I have to put the public ip of the host ?

 

[Dunuin]

If you would stick to the example it should be:

auto lo
iface lo inet loopback

auto eno0
#real IP address
iface eno0 inet static
        address 5.39.90.204/24
        gateway 5.39.90.254

auto vmbr0
#private sub network
iface vmbr0 inet static
        address  10.0.0.1/24
        bridge-ports none
        bridge-stp off
        bridge-fd 0

        post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.0.0.0/24' -o eno0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/24' -o eno0 -j MASQUERADE
    
        post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
        post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1

With your guests using IPs 10.0.0.2 to 10.0.0.254, some public DNS like 8.8.8.8 and 10.0.0.1 as the gateway.

 

[Sophie_Moreira]

thank you it works and also I find the solution very elegant