Network Isolation by Project on Single Server Incus Host

[Andrew_Wilson]

I would like to add a comment to help remind folks (like me) to set their firewall to allow for traffic to/from the new network(s), otherwise, like me, you might scratch around wondering why you can’t get connectivity. It took me ten minutes to figure it out (again) as I launched a container and it could not get an IP address from incus, and nor did it have connectivity. As usual, the error was my fault again:

E.g. for anyone using the uncomplicated firewall, ufw, I use these commands to get the firewall to talk nicely to the new incus ‘foo’ network per the above:

sudo ufw allow in on foo
sudo ufw route allow in on foo
sudo ufw route allow out on foo

Repeat for network bar too. And if you use iptables or some other application, hopefully these instructions still point you on how to do this.

A dated but still useful post (albeit for lxd) explains this well:

Lxd bridge doesn't work with IPv4 and UFW with nftables

As you can see getting the various firewall implementations to play nicely together is a non-trivial task. In the meantime these commands seems to suffice to allow traffic from lxdbr0 interface to the LXD host and for traffic from lxdbr0 to be routed to the external network without allowing all external inbound traffic: sudo ufw allow in on lxdbr0 sudo ufw route allow in on lxdbr0 sudo ufw route allow out on lxdbr0 See our page in the docs about this also: