Add multiple IPs of the same network to a LXC

[jsabater]

Hey everyone!

So I need a LXC in my Proxmox 7 cluster to have two IP addresses of the same 192.168.0.0/24 private network:

• 192.168.0.<id>, where <id> is the <ctid> assigned by Proxmox (i.e. 100, 101, 102, etc.).
• 192.168.0.254 (i.e this specific IP address).

I have achieved this by adding two network interfaces (eth0 and eth1) via the network interfaces configuration GUI but I've noticed that, in terms of firewall, the traffic is comming through net0, not net1, when it's directed at the 192.168.0.254 IP address.

I have tried to name the two interfaces eth0:0 and eth0:1 but the GUI regular expression validating the input won't let me.

Which is the recommended way to go? Configure eth0 though the GUI then edit /etc/network/interfaces (I'm on Debian 11) to create the second IP upon start-up of the container?

I ask because I don't think this is such a special case after all, but I could understand that the GUI can only support up to a certain amount of features.

Thanks in advance.

 

[shrdlicka]

Hello,
what is the reason behind needing two IPs for your container? If you are running some service on a specific IP did you bind it to the correct interface?

 

[jsabater]

The reason is that I run a PowerDNS Authoritative Server for two internal zones (forward and reverse) on the IP address 192.168.0.<id> and a PowerDNS Recursor (with access to the Internet to reach the hosting provider nameservers) on the IP address 192.168.0.254 in the same LXC, and both need to run on port 53, so I had to use two private IP addresses. I could certainly split them into two LXC, but I couldn't be bothered.

 

[bobmc]

the PowerDNS documentation suggests you can bind the service to a dedicated IP so it should be possible.

 

[jsabater]

Oh, it is possible! I already have it working fine. The Authoritative Server is listening on the IP address 192.168.0.<id> and the Recursor is listening on the IP addresses 127.0.0.1 and 192.168.0.254.

My question was not about that, but which was the recommended way to have to IP addresses of the same network in one LXC. I have it working with eth0 and eth1 and I would have usually set it up like eth0:0 and eth0:1, but the GUI does not allow that. That is what I wanted to clarify.

 

[shrdlicka]

I think this is totally up to you. You can just assign two IPs on the same interface in the container:

auto vmbr0
iface vmbr0 inet static
    address 192.168.16.32/20
    gateway 192.168.16.1
    bridge-ports eno1
    bridge-stp off
    bridge-fd 0

iface vmbr0 inet static
    address 192.168.18.168/20

But this might make it a bit in transparent in PVE gui because it only will show you one address.

If you configure two interfaces in the gui it will be like two different network ports for the container as far as I understand it. I tried with the dot notation and telles me they are on two different interfaces (if31 & if36).

30: eth0.0@if31: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 22:64:3d:92:68:ca brd ff:ff:ff:ff:ff:ff link-netnsid 0
35: eth0.1@if36: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 9e:96:5c:48:0f:67 brd ff:ff:ff:ff:ff:ff link-netnsid 0

It is more a choice what make it clearer to you that those two interfaces access the same subnet .

 

[jsabater]

But this might make it a bit in transparent in PVE gui because it only will showIf you configure two interfaces in the gui it will be like two different network ports for the container as far as I understand it. I tried with the dot notation and telles me they are on two different interfaces (if31 & if36).

Hmmm... dot notation. I hadn't thought of that! Let me see how the firewall behaves in that scenario and get back to you. Thanks!