Minimal UFW firewall rules to allow for DHCP?

[Joshua]

Hi,

My containers aren’t getting IPV4s , which I have determined be due to the firewall (I’m using UFW).

Without getting bogged down in my specific rules, I was wondering:

With the default ~lxdbr0~ network setup, what is the minimum firewall rules required for containers to get IPs, given that the default policy for both in and out is “deny”?

I would’ve thought (and maybe this is my lack of networking knowledge on show!) that you wouldn’t need any rules at all, since the DHCP request never leaves the ~lxdbr0~ interface, but that appears to not be the case for me.

Any help is appreciated, cheers.

[tomp (Thomas Parrott)]

This should help you:

Lxd bridge doesn't work with IPv4 and UFW with nftables

As you can see getting the various firewall implementations to play nicely together is a non-trivial task. In the meantime these commands seems to suffice to allow traffic from lxdbr0 interface to the LXD host and for traffic from lxdbr0 to be routed to the external network without allowing all external inbound traffic: sudo ufw allow in on lxdbr0 sudo ufw route allow in on lxdbr0 sudo ufw route allow out on lxdbr0 See our page in the docs about this also:

[Joshua]

Thanks a lot Thomas! That did the trick