Running OpenWrt (as a firewall/router) on a LXD host

Hi everyone,

So I’m getting started with LXD (super cool BTW, thank you all!) and to get my feet wet I decided to setup an all-in-one home-media-server/firewall doodah on a small mini-pc I had lying around, for the host OS I’m running Arch Linux (BTW :wink: ) on the latest zen kernel and for networking I’m using systemd-networkd and systemd-resolved.
Everything is working fine except for 2 things:
1- cannot pass a physical wifi device from host to container (ethernet works just fine though)
2- cannot reach the internet from the host even though host and openwrt can communicate (tested using iperf)

So here’s exactly what I’ve done so far:
:ballot_box_with_check: 1. setup a bridge device on the host to act as an internal switch






:ballot_box_with_check: 2. enable LXD socket: systemctl enable --now lxd.socket
:ballot_box_with_check: 2.1 Initialize LXD using: lxd init (without the default bridge).
:ballot_box_with_check: 3. create an OpenWrt instance: lxc launch images:openwrt/21.02 openwrt
:ballot_box_with_check: 3.1 add a wan interface: lxc config device add openwrt eth0 nic nictype=physical parent=eno1 name=eth0
:ballot_box_with_check: 3.2 add a lan interface: lxc config device add openwrt eth1 nic nictype=bridged parent=br0 name=eth1
:negative_squared_cross_mark: 3.3 add a wireless lan interface: lxc config device add openwrt wlan nic nictype=physical parent=wlan0 name=wlan

Error: Failed to start device “wlan”: Failed to attach interface: wlan0 to wlan: attaching specified netdev to the container failed

:ballot_box_with_check: 3.4 enable autostart: lxc config set openwrt boot.autostart true
:ballot_box_with_check: 3.5 set boot priority: lxc config set openwrt boot.autostart.priority 100
:ballot_box_with_check: 4. restart openwrt: lxc restart openwrt
:ballot_box_with_check: 5. connect to the OpenWrt web interface and configure wan and lan on eth0 and eth1 respectively (by default eth0 gets assigned as wan).
:ballot_box_with_check: 5.1 make OpenWrt is able to reach the internet. (e.g. ping
:ballot_box_with_check: 5.2 refresh package list and upgrade packages: opkg update && opkg upgrade $(opkg list-upgradable | cut -d " " -f 1)
:ballot_box_with_check: 5.3 install iperf opkg install iperf
:ballot_box_with_check: 5.4 run iperf in server mode iperf -s &
:ballot_box_with_check: 5.5 find out what ip address was assigned to host on lan: cat /tmp/dhcp.leases
:ballot_box_with_check: 5.6 ssh into host: ssh <user>@<assigned ip>
:ballot_box_with_check: 5.7 test connection between host and openwrt: iperf -c <openwrt-ip> -P $(nproc)
:negative_squared_cross_mark: 5.8 check if host can reach the internet ping or ping