I’ve completed setting up my comfortable set of LXC containers and want to save some points I spent a lot of time on, or things for copy-paste.
I used the official Ubuntu Server Guide, but the note in the Digital Ocean knowledge base also helped me a lot. I created 3 containers: one for VPN, one for the site on Drupal, and the last one as a www proxy for the second one, with nginx only.
Pretty simple: create a container with Ubuntu in it:
1lxc-create -n [container_name] -t ubuntu
Next, start it:
1lxc-start -d -n [container_name]
where the -d argument is essential; otherwise you will fall into the container’s command line and get stuck in it.
Attach to the started container:
1lxc-attach -n [container_name]
All containers are created with the default user:password «ubuntu:ubuntu». I strongly recommend deleting it; it is out of use:
1userdel ubuntu
2rm -rf /home/ubuntu
I wanted all my containers to start automatically. You can find the instructions in the Ubuntu server guide (edit /var/lib/lxc/[container_name]/config):
1# Autostart
2lxc.start.auto = 1
3lxc.start.delay = 5
Read this as follows: autostart the container and wait 5 seconds before starting the next one.
A VPN server does not work out of the box in an LXC container. You need to add the following option to the container config (/var/lib/lxc/[container_name]/config):
1# OpenVPN
2lxc.cgroup.devices.allow = c 10:200 rwm
The first time, you will also need to run commands as root to create the file for the tun device:
1mkdir /dev/net
2mknod /dev/net/tun c 10 200
3chmod 0666 /dev/net/tun
Notes from heider.io and boxtricks helped me.
I needed to forward ports 80 and 443 to the container with IP 10.0.3.100 and port 1194 (OpenVPN) to 10.0.3.200. To do so, run on the host machine:
1iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 10.0.3.100:80
2iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 10.0.3.100:443
3iptables -t nat -A PREROUTING -i eth0 -p udp --dport 1194 -j DNAT --to 10.0.3.200:1194
but these changes will be lost after reboot. To save them, install iptables-persistent:
1apt-get install -y iptables-persistent
and agree to save the current iptables settings.
The last problem was that the iptables rules were correct, but not loaded by iptables-persistent. However, if I ran service iptables-persistent start manually after booting, everything was ok and port forwarding worked. In /var/lib/boot.log I saw the line:
Loading iptables rules... [fail]
I believe the problem is in the boot and init order, so I made iptables-persistent start after the network is up. Create the file /etc/network/if-up.d/iptables-persistent:
#!/usr/bin/env bash
service iptables-persistent start
and make it executable:
chmod +x /etc/network/if-up.d/iptables-persistent
At the next boot, iptables will fail at boot, but will be reloaded after the network is up.