How to delegate routing between LXC in the same subnet ?

[HotSauce66]

Hello all, it's my first post here ! (let me know if I didn't do something right about posting on this forum

Here is my setup :
I have an dedicated router (ubiquiti) and a mini-pc hosting proxmox. On the proxmox, I have many LXC containers all with IPs in the same network (web servers, gitea, etc). They all got the same interface : vmbr0 which is a linux bridge. The bridge itself dont got any IP at all :


When I'm doing tests with pings, all containers communicate and the switching between them is done by proxmox.

I would like to delegate all the switching/routing to my router so I can define specific firewall rules (example : only allow access to the web container on port 80). Is it possible to do such a thing ? Maybe disable a parameter so all packets are forwarded to the default route ?
Just to specify, I would like to do all the networking/firewalling stuff on the same appliance (the ubiquiti router) because I have other things than the proxmox so I prefer to not do the rules on multiple places.

Thanks in advance for your answers !

 

[UdoB]

There is no routing inside of a single IP network. All traffic is forwarded inside the bridge from VMa to VMb in the very same way it is done in a physical switch.

To force a VM/LXC to send all packets to the router you would need to setup a /30 network for each one. That's the clean and "classic" solution.

There may be other solutions, involving some magic iptables rules, but I have no experience with this. Some other forum user might chime in, please.

 

[Gilou]

If you really need to isolate stuff, setup a VLAN / subnet for each zone you want to isolate, and use the router to decide what gets through ?