Lxbr0 outgoing ip



I got LXD 3.0.3 on Ubuntu 18.04 running with multiple containers.
All containers using lxdbr0 bridge.
The bridge uses ens3 interface which has 3 ip-addresses assign via netplan, lets call them

Now with IP tables I route traffic on certain IP/ports combinations to the containers. All fine. But the containers use always IP A) for outgoing traffic. But I need certain containers to use B) or C) as outgoing IP. I tried with a POSTROUTING rule and iptables

target     prot opt source               destination
MASQUERADE  all  --       !        /* generated for LXD network lxdbr0 */
SNAT       all  --          anywhere             to:

I think the default masquerade rule overrides this.

Is there a way to provide multiple bridges that use certain IPs for outgoing traffic? I do not want to have the container to get the PUBLIC ip internally (macvlan) - as described on simos blog.

(Stéphane Graber) #2

You can turn off LXD’s management of iptables in the network config, then do it yourself in a separate firewalling script on your system, that’d let you do the appropriate SNAT for outgoing traffic.


Hi Stephane,

thanks. I took the path with the SNAT rules but was not aware that I can turn LXDs management of iptables off.


lxc config set ip4.firewall false
lxc config set ip6.firewall false

would be sufficient? Thanks.

(Stéphane Graber) #4

It would be lxc network set lxdbr0 ipv4.firewall false but yes, that’s the idea.