Host has no route to container after update to Proxmox 4

[didi_bcg]

I did the migration following the instructions in the Proxmox Wiki (Convert OpenVZ to LXC).
So far everything looks good. The restored (OpenVZ->LXC) container is running and has Internet connectivity.
However I'm nomore able to connect from the host to the guest.

The config is:

$ cat /etc/network/interfaces
auto lo
iface lo inet loopback

iface eth0 inet manual

auto vmbr0
iface vmbr0 inet static
        address 188.40.101.72
        netmask 255.255.255.192
        gateway 188.40.101.65
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0

/etc/network/interfaces has not changed with the update.

Container network config:

pct set 126 -net0 name=eth0,bridge=vmbr0,ip=192.168.2.126/32

With the container running, that's the output of ifconfig and route:

$ ifconfig
eth0      Link encap:Ethernet  HWaddr 40:61:86:2b:87:c6  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:32308 errors:0 dropped:114 overruns:0 frame:0
          TX packets:25776 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:15543141 (14.8 MiB)  TX bytes:8091218 (7.7 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:10181 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10181 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:3031823 (2.8 MiB)  TX bytes:3031823 (2.8 MiB)

veth126i0 Link encap:Ethernet  HWaddr fe:51:8d:c1:8f:0f  
          inet6 addr: fe80::fc51:8dff:fec1:8f0f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10 errors:0 dropped:0 overruns:0 frame:0
          TX packets:490 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:812 (812.0 B)  TX bytes:31496 (30.7 KiB)

vmbr0     Link encap:Ethernet  HWaddr 40:61:86:2b:87:c6  
          inet addr:188.40.101.72  Bcast:188.40.101.127  Mask:255.255.255.192
          inet6 addr: fe80::4261:86ff:fe2b:87c6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:26852 errors:0 dropped:0 overruns:0 frame:0
          TX packets:24958 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:14808740 (14.1 MiB)  TX bytes:8036982 (7.6 MiB)

$ route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         static.65.101.4 0.0.0.0         UG    0      0        0 vmbr0
188.40.101.64   *               255.255.255.192 U     0      0        0 vmbr0

What I note here is that there's no route to the container's IP. With Proxmox 3, I had entried like this (automatically generated):

$ route
192.168.2.126   *               255.255.255.255 UH    0      0        0 venet0

What's missing here?

 

[dietmar]

What I note here is that there's no route to the container's IP.

Yes, there is no route. The container uses a different network, so it is up to you to
setup a route if you really need one.

 

[didi_bcg]

I see.
Why is it that this (setup of the route) used to happen automatically with Proxmox 3, but isn't after the update?
Can you give me a hint how to go back to a solution where this happens automatically when adding a container this way? Or should configuration of non-public network ifaces be done differently with LXC? Unfortunately the migration guide isn't very clear in that regard (at least for somebody with limited knowhow about LXC and networking config like me).

 

[didi_bcg]

Now I tried 2 other configurations:
1) The one in Wiki page Network_Model#Routed_Configuration (sorry, I'm not yet allowed to link). With that config I have the inverted problem: now the host can ping the container, but the container has no Internet access (at least with the container configs I tried).

2) No vmbr0 interface:

auto lo
iface lo inet loopback

# device: eth0
auto  eth0
iface eth0 inet static
  address   188.40.101.72
  broadcast 188.40.101.127
  netmask   255.255.255.192
  gateway   188.40.101.65
  # default route to access subnet
  up route add -net 188.40.101.64 netmask 255.255.255.192 gw 188.40.101.65 eth0

This is exactly the same as on a productive Proxmox 3 server (except of the specific IPs). It's the default config of the Hetzner Proxmox image, untouched, as it just works.
If I use this config on the Proxmox 4 machine, I find no network config which doesn't cause the container fail to start (vmbr0 doesn't exist, bridge=eth0 also doesn't work).

 

[didi_bcg]

Got it working with the routed configuration.
The problem was the ufw firewall having a denying forward policy by default.