[lxc-users] preventing multiple networks to connect to each other?

[Thomas Ward]

I strongly agree with the multiple subnets proposal because you can more easily filter traffic that way.  And you can have multiple bridges (and in turn profiles based on the default for each bridge) as well with different subnets and block comms that way across the nets.



*Sent from my iPhone.  Please excuse any typos, as they are likely to happen by accident.*

> On Oct 1, 2017, at 14:25, Mike Wright <nobody at nospam.hostisimo.com> wrote:
> 
>> On 10/01/2017 10:59 AM, Tomasz Chmielewski wrote:
>> I would like to have several networks on the same host - so I've created them with:
>> # lxc network create br-testing
>> # lxc network create br-staging
>> Then edited to match:
>> # lxc network show br-staging
>> config:
>>   ipv4.address: 10.191.0.1/24
>>   ipv4.dhcp.ranges: 10.191.0.50-10.191.0.254
>>   ipv4.nat: "false"
>> # lxc network show br-testing
>> config:
>>   ipv4.address: 10.190.0.1/24
>>   ipv4.dhcp.ranges: 10.190.0.50-10.190.0.254
>>   ipv4.nat: "false"
>> The problem is I'd like these network to be separated - i.e. containers using br-staging bridge should not be able to connect to br-testing containers, and the other way around. Both networks should be able to connect to hosts in the internet.
>> Is there any easy switch for that? So far, one thing which works is write my own iptables rules, but that gets messy with more networks.
> 
> Is there any reason to keep them on the same subnet?  How about: to the host 10.191.0.0/23 (or larger), then the subnets: 10.191.0.0/24 and 10.191.1.0/24.  Then iptables could easily block them from each other: -s 10.191.0.0/24 -d 10.191.1.0/24 -j DROP and -s 10.191.1.0/24 -d 10.191.0.0/24 -d DROP.
> _______________________________________________
> lxc-users mailing list
> lxc-users at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-users