Ubuntu 17.10搭建可外部SSH访问容器遇连接拒绝问题求助

Hey there, let's figure out why your friend can't SSH into your LXD container on Ubuntu 17.10, and also go over some solid alternatives if you're open to switching tools.

First, let's rule out the most common issues with LXD's network setup and container configuration:

1. Fix LXD Network Isolation #

By default, LXD uses the lxdbr0 bridge, which is a NAT-only network—this means external devices can't reach your container directly. You have two easy fixes here:

• Bridge to your physical network: Create a bridge that connects your container to the same LAN as your host, so it gets its own public (LAN) IP:

  # Create a bridge tied to your physical interface (replace eth0 with your actual interface)
  lxc network create br0 bridge.external_interfaces=eth0
  # Attach the default profile to this new bridge
  lxc profile device add default eth0 nic network=br0 name=eth0
  # Restart your container to apply the new network settings
  lxc restart <your-container-name>
  

  Now your container will have an IP on your local network, and your friend can SSH directly to that IP (assuming no firewalls block port 22).
• Port forwarding (no network reconfiguration): Map a port on your host to the container's SSH port (22) using iptables:

  # Replace <container-ip> with your container's internal IP, and 2222 with any unused host port
  iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2222 -j DNAT --to-destination <container-ip>:22
  iptables -A FORWARD -i eth0 -p tcp --dport 22 -d <container-ip> -j ACCEPT
  

  Your friend can then SSH to your-host-ip:2222 to reach the container.

2. Verify Container SSH Setup #

Don't skip these basics inside the container:

• Install OpenSSH server if you haven't: apt update && apt install openssh-server -y
• Ensure the SSH service is running: systemctl start sshd && systemctl enable sshd
• Check that the container's firewall (ufw) isn't blocking port 22: ufw allow 22 (or temporarily disable ufw with ufw disable for testing)

3. Check Host Firewall & IP Forwarding #

On your Ubuntu host:

• Allow the necessary traffic: If using port forwarding, run ufw allow 2222; if using a bridge, run ufw allow in on br0
• Enable IP forwarding (required for both methods):

  echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
  sysctl -p
  

If LXD's network config feels overcomplicated, these tools might be easier for your use case:

Docker #

Docker's port mapping is dead simple for exposing container services to the outside world. Here's a quick setup:

# Start an Ubuntu 17.10 container, map host port 2222 to container port 22
docker run -d -p 2222:22 --name ssh-ubuntu ubuntu:17.10
# Enter the container to set up SSH
docker exec -it ssh-ubuntu bash
# Inside the container: install SSH, set a root password, and exit
apt update && apt install openssh-server -y
passwd root
exit

Your friend can now SSH to your-host-ip:2222 with the root password you set. Docker's learning curve is gentler for simple use cases like this.

KVM/QEMU (Full Virtual Machines) #

If you need a more "real machine" experience, KVM lets you create full VMs with their own network interfaces. Just set the VM's network to bridge mode, and it'll get a LAN IP like any other device on your network—no port forwarding needed. Setup is a bit more involved than Docker, but it's great if you need isolation that's closer to physical hardware.

Before having your friend test, validate these locally first:

• Ping the container from your host to confirm network connectivity
• SSH into the container from your host to rule out container-side issues
• Test from another device on your local LAN to ensure host/network rules are working
• If your friend is connecting from outside your LAN, make sure your router has port forwarding enabled (map the host port to your host's local IP)

内容的提问来源于stack exchange，提问作者Silentassassin