Re: [libvirt-users] Networking issues with lxc containers in AWS EC2

On 04/11/2016 11:33 AM, Laine Stump wrote: I wouldn't be too quick to judgement. First take a look at tcpdump on the bridge interface that the containers are attached to, and on the ethernet device that connects the bridge to the rest of Amazon's infrastructure. If you see packets from the container's IP going out but not coming back in, check the iptables rules (again - firewalld uses iptables to setup its filtering) for a REJECT or DISCARD rule that has an incrementing count. I use something like this to narrow down the list I need to check: > > while true; do iptables -v -S -Z | grep -v '^Zeroing' | grep -v "c 0 > 0" | grep -e '-c'; echo '**************'; sleep 1; > > If you don't see any REJECT or DISCARD rules being triggered, then > maybe the problem is that AWS is providing an IP address to your > container's MAC, but isn't actually allowing traffic from that MAC > out onto the network. > I'll get this test setup. Unfortunately I'm not particularly knowledgeable with iptables; we don't use it in our product so I've never had to deal with it. I think you are right though about what's happening--AWS doesn't recognize the MAC addresses for containers running under another instance.