1
0
shorewall_code/docs/LXC.xml

157 lines
4.9 KiB
XML
Raw Normal View History

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<article>
<!--$Id$-->
<articleinfo>
<title>LXC and Shorewall</title>
<authorgroup>
<author>
<firstname>Tom</firstname>
<surname>Eastep</surname>
</author>
</authorgroup>
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
<copyright>
<year>2011</year>
<holder>Thomas M. Eastep</holder>
</copyright>
<legalnotice>
<para>Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
License</ulink></quote>.</para>
</legalnotice>
</articleinfo>
<section>
<title>Background</title>
<para>LXC (<ulink
url="http://lxc.sourceforge.net/">http://lxc.sourceforge.net/</ulink>) is
a set of user-space tools for managing the container capabilities that
have been in the Linux Kernel since 2.6.27.</para>
<para>This short article describes how I've implemented LXC here at
shorewall.net, with emphasis on the networking and firewall
aspects.</para>
</section>
<section>
<title>Overview of a Working Configuration</title>
<para>The following diagram shows the network at shorewall.net in the
spring of 2011.</para>
<graphic align="center" fileref="images/Network2011a.png" />
<para>As shown in that diagram, the LXC containers are bridged to br0.
Here are the relevant configuration entries.</para>
<para><filename>/etc/network/interfaces:</filename></para>
<programlisting>#
# LXC bridge
#
auto br0
iface br0 inet static
bridge_ports none
bridge_fd 0
address 70.90.191.121
broadcast 0.0.0.0
netmask 255.255.255.255
post-up ip route add 70.90.191.124/31 dev br0
iface br0 inet6 static
address 2001:470:b:227::41
netmask 124
</programlisting>
<para><filename>/etc/lxc/mail.conf</filename><programlisting>lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up
lxc.network.ipv4=70.90.191.124/29
lxc.network.ipv6=2001:470:b:227::42/124
</programlisting></para>
<para><filename>/etc/lxc/server.conf</filename><programlisting>lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up
lxc.network.ipv4=70.90.191.125/29
lxc.network.ipv6=2001:470:b:227::43/124
</programlisting></para>
<para>Note that I have subnetted 2001:470:b:227::/64 with a /124
(2001:470:b:227::40/124) assigned to the bridge. To make those addresses
accessible from the LOC zone, the following entries are required in
/etc/shorewall6/proxyndp:</para>
<programlisting>#ADDRESS INTERFACE EXTERNAL HAVEROUTE PERSISTENT
2001:470:b:227::41 - eth1 Yes Yes
2001:470:b:227::42 - eth1 Yes Yes
2001:470:b:227::43 - eth1 Yes Yes
</programlisting>
<para>The entries in the LXC .conf files are expected to configure eth0 in
the LXC containers; they do, <emphasis>sort of</emphasis>. In both of the
containers, no ipv6 default route was assigned. I corrected that by adding
this entry in <filename>/etc/sysctl.conf</filename> in both
containers:</para>
<programlisting>net.ipv6.conf.all.forwarding=0
</programlisting>
<para>I then added this stanza to <filename>/etc/radvd.conf</filename> on
the host:</para>
<programlisting>interface br0{
AdvSendAdvert on;
MinRtrAdvInterval 300;
MaxRtrAdvInterval 505;
AdvDefaultLifetime 9000;
route ::/0 {
AdvRouteLifetime infinity;
};
};
</programlisting>
<para>Curiosly, LXC gives container mail's eth0 this somewhat odd
configuration, and fails to add a default ipv4 route:</para>
<programlisting>14: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 4e:56:66:11:3c:6b brd ff:ff:ff:ff:ff:ff
inet 70.90.191.124/29 <emphasis role="bold">brd 70.90.191.120</emphasis> scope global eth0
inet6 2001:470:b:227::42/124 scope global
valid_lft forever preferred_lft forever
inet6 fe80::4c56:66ff:fe11:3c6b/64 scope link
valid_lft forever preferred_lft forever
</programlisting>
<para>So in that container's<filename> /etc/rc.local</filename>, I also
have:</para>
<programlisting>ip route add default via 70.90.191.121</programlisting>
<para>With the exception of the entries in
<filename>/etc/shorewall6/proxyndp</filename>. the Shorewall and
Shorewall6 configurations are fairly conventional three-interface setups.
In both configurations, the <filename>interfaces</filename> file entry for
br0 has the <option>routeback</option> option specified.</para>
</section>
</article>