Lxbr0 outgoing ip

I got LXD 3.0.3 on Ubuntu 18.04 running with multiple containers.
All containers using lxdbr0 bridge.
The bridge uses ens3 interface which has 3 ip-addresses assign via netplan, lets call them

Now with IP tables I route traffic on certain IP/ports combinations to the containers. All fine. But the containers use always IP A) for outgoing traffic. But I need certain containers to use B) or C) as outgoing IP. I tried with a POSTROUTING rule and iptables

target     prot opt source               destination
MASQUERADE  all  --       !        /* generated for LXD network lxdbr0 */
SNAT       all  --          anywhere             to:

I think the default masquerade rule overrides this.

Is there a way to provide multiple bridges that use certain IPs for outgoing traffic? I do not want to have the container to get the PUBLIC ip internally (macvlan) - as described on simos blog.

You can turn off LXD’s management of iptables in the network config, then do it yourself in a separate firewalling script on your system, that’d let you do the appropriate SNAT for outgoing traffic.

Hi Stephane,

thanks. I took the path with the SNAT rules but was not aware that I can turn LXDs management of iptables off.


lxc config set ip4.firewall false
lxc config set ip6.firewall false

would be sufficient? Thanks.

It would be lxc network set lxdbr0 ipv4.firewall false but yes, that’s the idea.

1 Like