mjhjmtu

I'm trying to set up DHCP for my lxcontainers without using lxc-net. The reason for this decision is that I'd like to place my containers in different networks, such that they are unable to talk to each other by default. I have successfully created and run containers using static IPs assigned within the containers' config file before, but I'd like to use a DHCP server on the host this time.

I've installed dnsmasq on my host and configured it like this:

# /etc/dnsmasq.d/dnsmasq.lxcbr.conf
domain=local.lxc,10.10.10.0/24
interface=lxcbr
dhcp-range=lxcbr,10.10.10.1,10.10.10.200,24h
dhcp-option=option:router,10.10.10.254

According to this the file is being loaded correctly:

root@host:~# service dnsmasq status
● dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server
 Loaded: loaded (/lib/systemd/system/dnsmasq.service; enabled)
 [...]
Feb 03 19:06:39 host dnsmasq[4228]: dnsmasq: syntax check OK.
Feb 03 19:06:39 host dnsmasq[4237]: started, version 2.72 cachesize 150
Feb 03 19:06:39 host dnsmasq[4237]: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect
Feb 03 19:06:39 host dnsmasq-dhcp[4237]: DHCP, IP range 10.10.10.1 -- 10.10.10.200, lease time 1d
Feb 03 19:06:39 host dnsmasq[4237]: reading /etc/resolv.conf
Feb 03 19:06:39 host dnsmasq[4237]: using nameserver upstream.nameserver.ip.here#53
Feb 03 19:06:39 host dnsmasq[4237]: using nameserver upstream.nameserver.ip.here#53
Feb 03 19:06:39 host dnsmasq[4237]: read /etc/hosts - 5 addresses

lxcbr is the host's interface in the container's network:

root@host:~# ifconfig
[...]

lxcbrBind Link encap:Ethernet HWaddr fe:60:7a:cc:56:64
 inet addr:10.10.10.254 Bcast:10.10.10.255 Mask:255.255.255.0
 inet6 addr: fe80::7a:56ff:fe82:921f/64 Scope:Link
 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
 RX packets:92 errors:0 dropped:0 overruns:0 frame:0
 TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
 collisions:0 txqueuelen:0
 RX bytes:5688 (5.5 KiB) TX bytes:928 (928.0 B)

veth0 Link encap:Ethernet HWaddr fe:60:7a:cc:56:64
 inet6 addr: fe80::fc60:7aff:fecc:5664/64 Scope:Link
 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
 RX packets:8 errors:0 dropped:0 overruns:0 frame:0
 TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
 collisions:0 txqueuelen:1000
 RX bytes:648 (648.0 B) TX bytes:648 (648.0 B)

veth0 is the container's veth interface:

# /var/lib/lxc/container
lxc.network.type = veth
lxc.network.name = veth0
lxc.network.flags = up
lxc.network.link = lxcbr
lxc.network.veth.pair = veth0

I assume I'm doing something very stupid but I've run out of ideas at this point.

I appreciate your help,
Christopher

1. 
   

   Make sure UDP packets have checksums
   In virtual networks UDP checksums are not being computed. This causes dhclient to reject offers. You can fix this by telling the host to recompute missing checksums:

   
   
   

   iptables -t mangle -A POSTROUTING -p udp -j CHECKSUM --checksum-fill

   
   



2. Execute dhclient on the container
   Because the containers /etc/network/interfaces is not used by LXC, you must execute dhclient manually.

The checksum filling solved the same issue for me.
You can be more precise by specifying the bridge interface where your LXC is attached:

iptables -t mangle -A POSTROUTING -p udp -j CHECKSUM -i bridge --checksum-fill

As for the automatic dhclient

Configure your interface to use dhcp in /etc/network/interfaces :

auto eth0
iface eth0 inet dhcp

then enable networking service in your container :

systemctl enable networking
systemctl start networking