[SOLVED] [P] Public IP on host - NAT - Masquerade: no connection to/from LXC container

[cmonty14]

Hello!

I have installed Proxmox VE 4.
I need to use NAT to create a local network for my LXC containers, and only the Proxmox VE host will keep the public IP.
Therefore I configured the host network as follows:

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback

iface eth0 inet manual

iface eth1 inet manual

auto bond0
iface bond0 inet manual
        slaves eth0 eth1
        bond_miimon 100
        bond_mode balance-xor

auto vmbr0
iface vmbr0 inet static
        address  192.168.100.12
        netmask  255.255.255.0
        gateway  192.168.100.1
        bridge_ports bond0
        bridge_stp off
        bridge_fd 0

auto vmbr1
iface vmbr1 inet static
        address  10.0.0.1
        netmask  255.255.255.0
        bridge_ports none
        bridge_stp off
        bridge_fd 0

        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up   iptables -t nat -A POSTROUTING -s '10.0.0.0/24' -o vmbr0 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '10.0.0.0/24' -o vmbr0 -j MASQUERADE

The network configuration of the LXC container is this:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet static
        address 10.0.0.102
        netmask 255.255.255.0
        gateway 10.0.0.1

In the container I can only ping the container itself, no other IP:

root@vm102-omv:~# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
^C
--- 10.0.0.1 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 4031ms

root@vm102-omv:~# ping 10.0.0.102
PING 10.0.0.102 (10.0.0.102) 56(84) bytes of data.
64 bytes from 10.0.0.102: icmp_req=1 ttl=64 time=0.132 ms
64 bytes from 10.0.0.102: icmp_req=2 ttl=64 time=0.075 ms
^C

On the host, I can ping the gateway but not the container IP:

user@pc3-supermicro:~$ ping 10.0.0.102
PING 10.0.0.102 (10.0.0.102) 56(84) bytes of data.
From 10.0.0.1 icmp_seq=1 Destination Host Unreachable
From 10.0.0.1 icmp_seq=5 Destination Host Unreachable
^C
--- 10.0.0.102 ping statistics ---
7 packets transmitted, 0 received, +2 errors, 100% packet loss, time 6000ms
pipe 4
1 user@pc3-supermicro:~$ ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.099 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.087 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.080 ms
^C
--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.080/0.088/0.099/0.013 ms

There's another thread reporting a similar issue, but the solution provided in this thread is not working.
Maybe this is related to the fact that I'm using LXC.

I'm wondering if this is related to an error in the LXC configuration. According to Debian Wiki a script to setup a natted network for lxc guests should be used.

Any advice is highly appreciated.

THX

---

Update:
Incorrect network configuration of containter:
wrong bridge selected

 

[maex]

thanks!