Search code examples
network-programmingdnslxc

No DNS inside lxc container

I have an LXC debian container which run on my archlinux host. I tried to setup a bridge (lxc-bridge-nat) using wlan0 but i can't ping the outside world from my container except if i ping using the ip instead of the domain name.

I can ping the container from the host and the host from the container.

Here some informations:

Host: ip addr 

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    link/ether d4:be:d9:70:bd:e5 brd ff:ff:ff:ff:ff:ff
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether c4:85:08:b4:5c:e9 brd ff:ff:ff:ff:ff:ff
    inet 192.168.42.121/24 brd 192.168.42.255 scope global wlan0
       valid_lft forever preferred_lft forever
    inet6 fe80::c685:8ff:feb4:5ce9/64 scope link 
       valid_lft forever preferred_lft forever
       valid_lft forever preferred_lft forever
4: lxc-bridge-nat: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether fe:b3:b7:a2:e1:31 brd ff:ff:ff:ff:ff:ff
    inet 192.168.50.1/24 brd 192.168.50.255 scope global lxc-bridge-nat
       valid_lft forever preferred_lft forever
    inet6 fe80::b0c8:d2ff:fe73:aa50/64 scope link 
       valid_lft forever preferred_lft forever

host: ip route 

default via 192.168.42.1 dev wlan0  proto static 
192.168.42.0/24 dev wlan0  proto kernel  scope link  src 192.168.42.121  metric 9 
192.168.50.0/24 dev lxc-bridge-nat  proto kernel  scope link  src 192.168.50.1

Container: ip addr 

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
10: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:ff:aa:00:00:01 brd ff:ff:ff:ff:ff:ff
    inet 192.168.50.2/24 brd 192.168.50.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::2ff:aaff:fe00:1/64 scope link 
       valid_lft forever preferred_lft forever

Container: ip route

default via 192.168.50.1 dev eth0 
192.168.50.0/24 dev eth0  proto kernel  scope link  src 192.168.50.2

Container: /etc/resolv.conf

nameserver 212.27.40.240
nameserver 212.27.40.241
Solution

  • Hostnames not resolving points immediately to the DNS servers, and posting the content of resolv.conf was useful here; they were the only part of this setup outside of your immediate control.

    As you've found, simply pinging a remote server doesn't always help - running nslookup against them showed that they were the problem. (As a counterpoint, due to the way ping itself works a lack of response from a ping doesn't mean the server is down - pings are trivial to block at firewall level.)

    To work around to your DNS issue, you can make use of other DNS servers, such as those hosted by Google. Simply alter your resolv.conf to:

    nameserver 8.8.8.8
nameserver 8.8.4.4