Multiple LXC guests with dedicated public static IP address

LXD
1

Hello,

I am in the process of consolidating a set of SMTP servers on a LXD host with multiple LXC guests, one foreach SMTP. (smtp1, smtp2 etc)
Each smtpX need its own public static IP address to be able to send/receive emails without NAT: the containers need to “know” their public IP address as well as receive traffic directly from the internet on port 25, 587 etc.
From the internet it would appear as if X smtp server would be a baremetal server with it own IP, filtering rules, hostname…

Previous setup relying on plain old LXC was relying on eth0 aliases for each public IP address (eth0:0, eth0:1 etc), along with allocation of a “phys” interfaces.
Since the introduction of wonderful new tools (netplan et al), eth aliasing seems to be deprecated.

What would be the recommended setup to have “n” containers with 1 public IP interface, eventually with a local interface connected to lxdbr0 but this is not required?
I would prefer to avoid having to create “n” bridges, which would be complex to manage and which would prevent each container to “see” its public IP address.

Inter-container communication is not required nor is container-host communication.

I basically need to connect all containers directly to the internet as I would with baremetal servers. Any suggestion welcome :slight_smile:

2

Is this for LXD or LXC (you have posted in LXD category, but title suggests LXC).

Either way I would suggest using the routed NIC type, as that maps pretty well to your previous use of IP alias interfaces.

Also this doesn’t need a bridge, and will re-use the host’s MAC address (which can be useful with some hosting providers who restrict multiple MACs).

See https://linuxcontainers.org/lxd/docs/master/instances#nictype-routed

Or https://linuxcontainers.org/lxc/manpages//man5/lxc.container.conf.5.html (search for “router”).

3

Thank you,
I had seen the “routed” type NIC but had not identified it as a potential solution for this use case. The fact that this can be managed directly via LXD without any prior declaration on the host is very different from our current setup which required NIC alias declaration before anything can happen in the containers.