How to delegate routing between LXC in the same subnet ?

H

HotSauce66

New Member
Jan 27, 2026
2
0
1
Hello all, it's my first post here ! (let me know if I didn't do something right about posting on this forum :)

Here is my setup :
I have an dedicated router (ubiquiti) and a mini-pc hosting proxmox. On the proxmox, I have many LXC containers all with IPs in the same network (web servers, gitea, etc). They all got the same interface : vmbr0 which is a linux bridge. The bridge itself dont got any IP at all :
1769554759330.png

When I'm doing tests with pings, all containers communicate and the switching between them is done by proxmox.

I would like to delegate all the switching/routing to my router so I can define specific firewall rules (example : only allow access to the web container on port 80). Is it possible to do such a thing ? Maybe disable a parameter so all packets are forwarded to the default route ?
Just to specify, I would like to do all the networking/firewalling stuff on the same appliance (the ubiquiti router) because I have other things than the proxmox so I prefer to not do the rules on multiple places.

Thanks in advance for your answers ! :)
 
Last edited:
There is no routing inside of a single IP network. All traffic is forwarded inside the bridge from VMa to VMb in the very same way it is done in a physical switch.

To force a VM/LXC to send all packets to the router you would need to setup a /30 network for each one. That's the clean and "classic" solution.

There may be other solutions, involving some magic iptables rules, but I have no experience with this. Some other forum user might chime in, please.
 
  • Like
Reactions: bl1mp
First, thanks all fors your answers !

I tried to assign an IP with a /32 mask and it seems to work as expected !

For the subnet suggestion from Gilou, I don't think it will fit my needs because I would like to manage "every IP individually". For example, only allow access to IP X.X.X.X on port 80 and 443 (for a web server). In this case, I'd need as many subnets as I have machines I guess. Maybe too complexe for what I'm looking for.

I'm still open to new suggestions is there are any :)
 
You must log in or register to reply here.
Top Bottom
Back