I have been assigned a block of /29 ips for a dedicated server I rent. I want to be able to keep one of these IPs for managing the server itself, and forward each of the rest to its own internal subnet, for multiple OpenVZ containers to be able to share public IPs.

For instance, I might have two web servers and two file servers in 4 containers. This is not the actual services that will be running, but for easy of example I will use them. I want one of my public IPs (XX.XX.XX.2) to point to the two containers on the subnet, and the other public IP (XX.XX.XX.3) to point to the containers in the subnet. Communication between the subnets is not required, but each container must be able to access the web.

I have tried using sourced based routing as described here and NAT as described on the OpenVZ wiki here without success. Host is running Centos 6, and each VM is running Debian 7 if that makes a difference.

  • Can you pls detail what you mean by without success? What is failing? Error messages? – MariusMatutiae Jun 16 '15 at 11:50
  • No errors per se, but just no internet connection on the VMs - can't ping anything past Host node, address or IP, traceroutes fails at host node. Nameservers are correct - using google public DNS for testing. – Adam Dodman Jun 16 '15 at 12:41
  • Pls post the output of ip addr show and of ip route show, thanks. – MariusMatutiae Jun 16 '15 at 13:51
  • Too long for comment so uploaded to pastebin here – Adam Dodman Jun 16 '15 at 14:17
  • From ip addr show output and seem to have incorrect masks – Silvio Massina Jun 16 '15 at 14:26
  1. Set up your openvz containers to use bridged networking (using veth interfaces).

  2. Create a bridge for each of the internal networks you want to connect your containers to (in your case 2 bridges, one for and one for Let's call them br2 and br3).

  3. Give to each bridge an ip address on the correct network (for example br2 could be and br3

  4. Configure the containers connecting them to their respective bridges.

    For example connect to br2 the containers that should reside on network (let's say they are CT1 and CT2) and to br3 the ones that you want on (let's say they are CT3 and CT4).

  5. Give to each container an IP address on the same network of the bridge they are connected to. Set the ip address of the bridge ad the default gateway.

    For example: CT1 and CT2 with IP and Their gateway will be (IP address of br2)

  6. Enable ip forwarding on the physical host

  7. Configure all the public IPs on the physical host's interface connected to the Internet (let's say it's eth0), with the correct subnet mask.

  8. Configure NAT for your CTs as follows:

    iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to first.pulic.ip.address
    iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to second.pulic.ip.address

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.