Host-to-container OVN connectivity

Project Discussion LXD Support
1

Hello, I have setup a cluster with 4 nodes and OVN. Containers get their IP addresses correctly on the OVN interface and can seen each other inter-node correctly.

I’d also like to join the hosts into the OVN so that they can get an address in the range and see the containers over this network.

# lxc network show lxdovn0
name: lxdovn0
description: ""
type: ovn
managed: true
status: Created
config:
  bridge.mtu: "1442"
  ipv4.address: 10.118.215.1/24
  ipv4.nat: "true"
  network: UPLINK
  volatile.network.ipv4.address: 10.0.0.80


# lxc ls

+---------+---------+---------------------+------+-----------+-----------+---------------------+
|  NAME   |  STATE  |        IPV4         | IPV6 |   TYPE    | SNAPSHOTS |      LOCATION       |
+---------+---------+---------------------+------+-----------+-----------+---------------------+
| control | RUNNING | 10.118.215.4 (eth0) |      | CONTAINER | 0         | core02			   |
+---------+---------+---------------------+------+-----------+-----------+---------------------+
| proxy01 | RUNNING | 10.118.215.2 (eth0) |      | CONTAINER | 0         | core01              |
+---------+---------+---------------------+------+-----------+-----------+---------------------+


core01 # ping 10.118.215.2
PING 10.118.215.2 (10.118.215.2) 56(84) bytes of data.
^C
--- 10.118.215.2 ping statistics ---
506 packets transmitted, 0 received, 100% packet loss, time 517149ms

Is it possible? Do you have some guidance?

Thanks!

2

Hi, the host itself doesn’t need to have an address in the lxdovn0 network. It sufficient if you modify the host’s routes so that it knows how to reach this network.
By default the host doesn’t know where 10.118.215.0/24 is located at.

So what you have to do is add another entry to your host’s routing table which tells your host that 10.118.215.0/24 is reachable through the OVN network’s virtual router with volatile.network.ipv4.address: 10.0.0.80:

ip route add 10.118.215.0/24 via 10.0.0.80

This command assumes that your host has a leg in the UPLINK network or it can reach it through it’s default gateway.

You can then ping 10.118.215.2 from your host.

1 Like
3

Thanks @jpelizaeus for the quick feedback. I’ve added the route and I’m now able to ping 10.118.215.2 from the host.

However connecting to network services on the container (http, ssh) fails:

root@core01 ~ # ip route
default via <public ip> dev enp0s31f6 proto static onlink
10.0.0.0/24 dev br0 proto kernel scope link src 10.0.0.2
10.0.0.0/24 via 10.0.0.1 dev br0 proto static metric 100 onlink
10.1.100.0/24 dev lxdbr0 proto kernel scope link src 10.1.100.1
10.118.215.0/24 via 10.0.0.80 dev br0
192.168.100.0/24 dev vlan4000 proto kernel scope link src 192.168.100.2

root@core01 ~ # nc -zv 10.118.215.2 22
Connection to 10.118.215.2 22 port [tcp/ssh] succeeded!

root@core01~ # ssh 10.118.215.2
^C

The final goal is to be able to expose to the Internet some network services hosted on the containers and I was thinking to achieve that via forwarding rules on public ip → 10.0.0.80 and then a Network Forward on 10.0.0.80.

4

Mh, some firewall within the instance maybe?

The final goal is to be able to expose to the Internet some network services hosted on the containers and I was thinking to achieve that via forwarding rules

Have you checked https://documentation.ubuntu.com/microcloud/latest/lxd/howto/network_forwards/#network-forwards already?

5

Hello,

You can then ping 10.118.215.2 from your host

I can confirm it works now.

Have you checked https://documentation.ubuntu.com/microcloud/latest/lxd/howto/network_forwards/#network-forwards already?

I’m using network forwards with bridge networks since years now, and they are of great help.

With OVN networks I’ve setup the following to be able to expose a HTTPS service running on a container with internal IP 10.0.0.91 and in a physical LXD server with a public ip IP1:

  1. Create a nft ruleset as follows:
table inet lxd {
	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
		ip daddr IP1 tcp dport 443 dnat ip to 10.0.0.91:443
	}

	chain OUTPUT {
		type nat hook output priority dstnat; policy accept;
		ip daddr IP1 tcp dport 443 dnat ip to 10.0.0.91:443
	}

	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
	  oifname != "lo" masquerade	
	}
}
  1. Create a network forward on lxdovn0, the network
# lxc network forward show lxdovn0 10.0.0.91
listen_address: 10.0.0.91
location: ""
description: ""
config: {}
ports:
- description: https port forward to proxy01
  protocol: tcp
  listen_port: "443"
  target_port: "443"
  target_address: 10.79.237.3

Definition of lxdovn0:

root@core01-fsn1-hetzner ~ # lxc network show lxdovn0
name: lxdovn0
description: ""
type: ovn
managed: true
status: Created
config:
  bridge.mtu: "1442"
  ipv4.address: 10.79.237.1/24
  ipv4.nat: "true"
  network: UPLINK
  volatile.network.ipv4.address: 10.0.0.91
used_by:
locations:
project: central-services

Definition of UPLINK:

root@core01-fsn1-hetzner ~ # lxc network show UPLINK
name: UPLINK
description: ""
type: physical
managed: true
status: Created
config:
  dns.nameservers: NS1
  ipv4.gateway: 10.0.0.2/24
  ipv4.ovn.ranges: 10.0.0.91-10.0.0.100
  ipv4.routes: 10.0.0.91/32,138.IP1
  volatile.last_state.created: "false"
used_by:
- /1.0/networks/lxdovn0
locations:
project:

This works fine. However it needs a manually written and to-maintain nft ruleset. I’ve tried adding IP1 to `ipv4.routes` and then defining a network forward on it with a similar forwarding rule. The network forward is correctly created but the forwarding doesn’t.

So the question is (a little bit off-topic with respect of the title of this post): is there a way to define a NETWORK FORWARD on a public IP to simplify the setup?