Fix DNS in LXC Containers on VPN VLANs

Summary: LXC containers on VPN-protected VLANs often fail to resolve external hostnames out of the box. This causes "Name or service not known" errors in apps like Prowlarr, apt, and curl. The correct fix is to set DNS via the Proxmox host using pct set --nameserver — do NOT lock resolv.conf with chattr +i inside the container as it will prevent the container from booting.

Symptoms

• Prowlarr indexer test fails: Name or service not known (1337x.to:443)
• apt update fails with Temporary failure resolving 'deb.debian.org'
• curl or nslookup can't resolve any external domain
• Everything that requires internet by name fails, but IP-based connections work

Why It Happens

LXC containers on a VPN-protected VLAN inherit the network path but not necessarily a working DNS resolver. The VPN gateway may not forward DNS queries, or /etc/resolv.conf may be empty or pointing to a non-existent nameserver.

Diagnose

Check what DNS is currently configured (inside the container):

cat /etc/resolv.conf

Test if DNS resolution works:

nslookup google.com
nslookup 1337x.to

Confirm IP connectivity still works (rules out a broader network issue):

ping -c3 9.9.9.9    # ping by IP, not hostname

If IP ping works but hostname resolution fails — it's DNS only.

Fix: Set DNS via Proxmox Host

Run on the Proxmox host (not inside the container). This is the correct method for Proxmox LXC — Proxmox writes resolv.conf at container startup via its pre-start hook:

pct set <CTID> --nameserver "9.9.9.9 149.112.112.112"

For all arr stack containers at once:

pct set 201 --nameserver "9.9.9.9 149.112.112.112"
pct set 202 --nameserver "9.9.9.9 149.112.112.112"
pct set 203 --nameserver "9.9.9.9 149.112.112.112"
pct set 204 --nameserver "9.9.9.9 149.112.112.112"
pct set 205 --nameserver "9.9.9.9 149.112.112.112"
pct set 206 --nameserver "9.9.9.9 149.112.112.112"
pct set 207 --nameserver "9.9.9.9 149.112.112.112"

Reboot each container, then verify inside:

nslookup google.com    # should resolve cleanly

Why Quad9 (9.9.9.9): Privacy-focused, blocks known malicious domains, operated by a non-profit. Good default for home lab containers behind VPN.

Alternatives: Cloudflare 1.1.1.1 / 1.0.0.1 — Google 8.8.8.8 / 8.8.4.4

⛔ Do NOT Use chattr +i Inside the Container

It seems logical to lock resolv.conf with chattr +i to prevent it being overwritten — do not do this on Proxmox LXC containers.

Proxmox's lxc-pve-prestart-hook renames and rewrites resolv.conf at every container startup. If the file is immutable, the hook fails with:

close (rename) atomic file '/etc/resolv.conf' failed: Operation not permitted
error in setup task PVE::LXC::Setup::pre_start_hook

The container will not boot. Confirmed issue — validated 2026-05-25.

Recovery if chattr +i Was Applied

Remove the immutable flag from the Proxmox host (container must be stopped):

# Find the rootfs path
pct config <CTID> | grep rootfs
# Returns something like: flash:subvol-203-disk-0,size=8G

# Remove the immutable flag
chattr -i /flash/subvol-<CTID>-disk-0/etc/resolv.conf

# Start the container
pct start <CTID>

# Then set DNS correctly via pct set
pct set <CTID> --nameserver "9.9.9.9 149.112.112.112"

Quick Reference