ACL's for very specific subnet isolation

[chuckboecking]

Please note:

Network Isolation by Project on Single Server Incus Host

Hi Team, I have a single incus host server (not clustered). I want to be able to isolate instances (from a networking perspective) to only communicate with containers in the same project and still be able to communicate with the outside world. My assumption is that you can create a bridged network per project; however, I do not know the best way to prevent communication between network bridges. This instance will most likely have 10+ projects. If the host firewall needs to control communicatio…

Below is a more concise example of using iptables to allow containers/vms of one bridge to talk containers/vms/ on another (specific) bridge:

Incus Linux containers for dummies

I believe it is worth reviewing this thread as well: https://discuss.linuxcontainers.org/t/network-isolation-by-project-on-single-server-incus-host/ It talks demonstrates how you can create a new bridge and quickly isolate traffic between containers on that bridge. Here is a quick example: Block traffic between all incus bridges (note the wildcard ‘+’): sudo iptables -A FORWARD -i incusbr+ -o incusbr+ -j REJECT Allow for exceptions if needed: sudo iptables -A FORWARD -i incusbr4 -o incusbr…

This solution is probably not as concise as you want; however, it gives you some degree of control.

Does this help?