Routing Public IPv6 Addresses To LXC/LXD Containers

Learn how routing public IPv6 addresses to LXC/LXD containers works with simple commands and real examples that make your setup quick and reliable. Our Live Support Team is always here to help you.

Giving Every LXC/LXD Container Its Own Public IPv6 Address

Routing public IPv6 addresses to LXC/LXD containers isn’t rocket science once you understand the logic behind it. The massive IPv6 address space most VPS providers offer makes it possible to assign each container its own public IPv6. Let’s go through how it’s done, clearly, quickly, and with all the right commands intact.

Start by Spinning Up Your Container

Before anything else, ensure your container is ready. You probably already have one, but for clarity, here’s a quick reminder:

lxc launch ubuntu:18.04 my-container

That’s your base. Once that’s running, you’re ready to move ahead with routing public IPv6 addresses to LXC/LXD containers.

Decide Which IPv6 Address You’ll Use

You’ll first need to know what IPv6 prefix your provider has routed to your host. You can find that in your hosting control panel, it usually looks like this:

2a01:4f9:c010:278::1/64

Alternatively, you can run:

sudo ifconfig

Check for the inet6 line under your main network interface. Remember, addresses starting with fe80:: or fd are not public IPv6 addresses.

Now, you can assign one from your prefix range. Most people use <prefix>::1 for the host, so maybe go with <prefix>::2 for your container. If you’d rather be less predictable, try something like <prefix>:af15:99b1:0b05:1.

For this example, we’ll use:

2a01:4f9:c010:278::8

That’s your container’s public IPv6.

Find Your Container’s Internal IPv6 (ULA)

Next, you need the container’s local IPv6 address. That’s simple with this command:

lxc list

You’ll see something like:

+--------------+---------+-----------------------+-----------------------------------------------+

| NAME | STATE | IPV4 | IPV6 |

+--------------+---------+-----------------------+-----------------------------------------------+

| my-container | RUNNING | 10.144.118.232 (eth0)| fd42:830b:36dc:3691:216:3eff:fed1:9058 (eth0)|

+--------------+---------+-----------------------+-----------------------------------------------+

Copy the private IPv6 address from the IPv6 column. In this case:
fd42:830b:36dc:3691:216:3eff:fed1:9058

Route the Public IPv6 to the Container

Now it’s time to link your chosen public IPv6 with the container’s private one. This is where the magic happens:

sudo ip6tables -t nat -A PREROUTING -d <public IPv6> -j DNAT –to-destination <container private IPv6>

For this example:

sudo ip6tables -t nat -A PREROUTING -d 2a01:4f9:c010:278::8 -j DNAT --to-destination fd42:830b:36dc:3691:216:3eff:fed1:9058

Run it and check for any errors. If it works, you can make it permanent by adding the command to /etc/rc.local (right after #!/bin/bash, before exit 0).

Advanced users can prefer adding it inside /etc/network/interfaces.

SSH into Your Container Using the Public IPv6

This part is optional but handy. Make sure your system supports IPv6 — you can test it on ipv6-test.com
.

Open a shell inside your container:

lxc exec my-container bash

You’ll now see:
root@my-container:~#

Inside the container, create a user:

root@my-container:~# adduser uli

Follow the prompts to set a password and just hit Enter for the rest.

The default Ubuntu 18.04 image disables SSH password login. So, open /etc/ssh/sshd_config and change:

PasswordAuthentication no → PasswordAuthentication yes

Then restart SSH:

service sshd restart

Once done, log out with Ctrl+D, and connect to your container using its public IPv6:

ssh <username>@<public IPv6 address>

For example:

ssh uli@2a01:4f9:c010:278::8

If everything’s correct, you’ll see:
uli@my-container:~$

And you’re in.

Don’t Skip the Firewall

Before wrapping up, enable a firewall inside your container (like ufw). The container’s IPv6 address is public, so keeping it secure is crucial.

Conclusion

Routing public IPv6 addresses to LXC/LXD containers gives each container its own identity on the internet. It’s simple, efficient, and powerful once set up correctly, and with these steps, you can get it working in minutes.