nixpkgs/nixos/doc/manual/administration/container-networking.xml

<section  xmlns="http://docbook.org/ns/docbook"
          xmlns:xlink="http://www.w3.org/1999/xlink"
          xmlns:xi="http://www.w3.org/2001/XInclude"
          version="5.0"
          xml:id="sec-container-networking">
 <title>Container Networking</title>

 <para>
  When you create a container using <literal>nixos-container create</literal>,
  it gets it own private IPv4 address in the range
  <literal>10.233.0.0/16</literal>. You can get the container’s IPv4 address
  as follows:
<screen>
<prompt># </prompt>nixos-container show-ip foo
10.233.4.2

<prompt>$ </prompt>ping -c1 10.233.4.2
64 bytes from 10.233.4.2: icmp_seq=1 ttl=64 time=0.106 ms
</screen>
 </para>

 <para>
  Networking is implemented using a pair of virtual Ethernet devices. The
  network interface in the container is called <literal>eth0</literal>, while
  the matching interface in the host is called
  <literal>ve-<replaceable>container-name</replaceable></literal> (e.g.,
  <literal>ve-foo</literal>). The container has its own network namespace and
  the <literal>CAP_NET_ADMIN</literal> capability, so it can perform arbitrary
  network configuration such as setting up firewall rules, without affecting or
  having access to the host’s network.
 </para>

 <para>
  By default, containers cannot talk to the outside network. If you want that,
  you should set up Network Address Translation (NAT) rules on the host to
  rewrite container traffic to use your external IP address. This can be
  accomplished using the following configuration on the host:
<programlisting>
<xref linkend="opt-networking.nat.enable"/> = true;
<xref linkend="opt-networking.nat.internalInterfaces"/> = ["ve-+"];
<xref linkend="opt-networking.nat.externalInterface"/> = "eth0";
</programlisting>
  where <literal>eth0</literal> should be replaced with the desired external
  interface. Note that <literal>ve-+</literal> is a wildcard that matches all
  container interfaces.
 </para>

 <para>
  If you are using Network Manager, you need to explicitly prevent it from
  managing container interfaces:
<programlisting>
networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
</programlisting>
 </para>

 <para>
  You may need to restart your system for the changes to take effect.
 </para>
</section>