Assigning a public IP to a LXC container

[Thykeadams]

Hello fellow Proxmoxers!, I just have a quick question as I cant find an answer to it anywhere. I am trying to setup a machine with 4 IP Addresses to have 3 LXC containers each with their own Public IPV4 Address, but I cant seem to get the network config working.

My current host network config looks like this:

auto lo
iface lo inet loopback

iface eth0 inet manual
iface eth1 inet manual
auto vmbr0
iface vmbr0 inet static
        address 1xx.xxx.60.205/24
        gateway 1xx.xxx.xx.1
        bridge-ports eth0
        bridge-stp off
        bridge-fd 0

auto vmbr1
iface vmbr1 inet static
        address 2xx.xxx.xx.59/24
        bridge-ports eth1
        bridge-stp off
        bridge-fd 0

How would I go about setting an IP address to the LXC container. Say I wanted `example:` 99.233.59.123 pointed to CT 1 and only CT 1, how would that work?

 

[bobmc]

I would start here
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_network_configuration

 

[Thykeadams]

I would start here
https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_network_configuration

What would the CTs config look like, I replicated the

3.3.4. Default Configuration using a Bridge​

config but still cant get it to work correctly with making the CT have its on IP

 

[bobmc]

auto lo
iface lo inet loopback

iface eth0 inet static
        address  1xx.xxx.60.205/24
        gateway  1xx.xxx.60.1
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp


auto vmbr0
iface vmbr0 inet static
        address  99.233.59.121/29
        bridge-ports none
        bridge-stp off
        bridge-fd 0

arch: amd64
cores: 1
hostname: ct1
memory: 512
net0: name=eth0,bridge=vmbr0,gw=99.233.59.121,hwaddr=XX:XX:XX:XX:XX:XX:XX:XX,ip=99.233.59.123/29,type=veth
onboot: 0
ostype: debian
rootfs: ctstore:vm-201-disk-0,size=8G
swap: 512
unprivileged: 1

 

[Thykeadams]

auto lo
iface lo inet loopback

iface eth0 inet static
        address  1xx.xxx.60.205/24
        gateway  1xx.xxx.60.1
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp


auto vmbr0
iface vmbr0 inet static
        address  99.233.59.121/29
        bridge-ports none
        bridge-stp off
        bridge-fd 0

arch: amd64
cores: 1
hostname: ct1
memory: 512
net0: name=eth0,bridge=vmbr0,gw=99.233.59.121,hwaddr=XX:XX:XX:XX:XX:XX:XX:XX,ip=99.233.59.123/29,type=veth
onboot: 0
ostype: debian
rootfs: ctstore:vm-201-disk-0,size=8G
swap: 512
unprivileged: 1

I see you used gateway as the IP I wanted, is that how its supposed to be or? Where did you get the ...59.121 IP address?

 

[bobmc]

Well you proposed the 99.233.59.0 network, otherwise it is guess work and assumption as I don't have all of your config information.

For that scheme to work, at least one of your allocated IP addresses would need to be allocated to the role of routing address (aka network gateway) and assigned to the vmbr0 interface. The remaining IP's can be assigned directly to your containers or VM's

It's possible to share the gateway IP by using port forwarding - so if you needed to use that ....59.121 address in our example for a web site say, you could forward http traffic on port 80 and 443 to a CT or VM using a private non-routable, ip address.

Having said that, you do need to speak to your hosting provider support to ensure that this is not going to breach any of their security policies.

 

[Thykeadams]

Well you proposed the 99.233.59.0 network, otherwise it is guess work and assumption as I don't have all of your config information.

For that scheme to work, at least one of your allocated IP addresses would need to be allocated to the role of routing address (aka network gateway) and assigned to the vmbr0 interface. The remaining IP's can be assigned directly to your containers or VM's

It's possible to share the gateway IP by using port forwarding - so if you needed to use that ....59.121 address in our example for a web site say, you could forward http traffic on port 80 and 443 to a CT or VM using a private non-routable, ip address.

Having said that, you do need to speak to your hosting provider support to ensure that this is not going to breach any of their security policies.

Could that "allocated IP" be the same IP used to access the PVE server or does it have to be an entirely different one? Would you need 3 IP addresses for it to work correctly? (Sorry if I am buggin you, I'm new to this kind of networking)

 

[bobmc]

There are multiple ways of doing this and no right or wrong way. We are working on the assumption that the Proxmox host IP is on a different subnet to the one's allocated to the VM's - yes?