LXC cannot reach the Internets

[pikesley]

Never bet against me having done something wrong, but the containers don't seem to be able to get the wider internet, and so cannot retrieve any packages. Using the devop-test-1 container from this repo:

root@devop-test-1:~# netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.255.254 0.0.0.0         UG        0 0          0 eth0
192.168.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0

root@devop-test-1:~# ping -c 1 192.168.255.254
PING 192.168.255.254 (192.168.255.254) 56(84) bytes of data.
64 bytes from 192.168.255.254: icmp_seq=1 ttl=64 time=0.067 ms

--- 192.168.255.254 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.067/0.067/0.067/0.000 ms

root@devop-test-1:~# ping -c 1 -w 10 pikesley.org
PING pikesley.org (82.113.146.98) 56(84) bytes of data.

--- pikesley.org ping statistics ---
10 packets transmitted, 0 received, 100% packet loss, time 9069ms

I guess that gateway (the test-lab) should be forwarding packets. Have I done something dumb?

S

[pikesley]

I got a fix. An ugly, ugly fix. Once your test-lab is up:

bundle exec cucumber-chef ssh

(or via binstubs, or however you roll). Then on that box:

head -$((`wc -l /etc/rc.local | cut -d ' ' -f 1` - 1)) /etc/rc.local > /tmp/rc.local && for line in "/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE" "/sbin/iptables -A FORWARD -i eth0 -o br1 -m state --state RELATED,ESTABLISHED -j ACCEPT" "/sbin/iptables -A FORWARD -i eth1 -o br1 -j ACCEPT" ; do echo ${line} >> /tmp/rc.local ; done && echo "exit 0" >> /tmp/rc.local && sudo cp /tmp/rc.local /etc/ 
sudo /etc/rc.local 2> /dev/null
echo "1" | sudo tee /proc/sys/net/ipv4/ip_forward

and then to make sure this survives a reboot:

echo net.ipv4.ip_forward=1 | sudo tee -a /etc/sysctl.conf > /dev/null

and now your containers can reach the outside world.

I'm sure this should be baked into the cuke-chef provisioning somehow, but I know not where.

[pikesley]

The iptables commands are fully cargo-culted from various howtos, there may well be better ways to achieve the same result.

[pikesley]

Also, this is on Vagrant/VirtualBox. Maybe this all works fine on AWS.

[ixnu]

Thanks John Frum.

I am confounded why this cult knowledge is so obscure.