About this list Date view Thread view Subject view Author view Attachment view

From: MH - Entwicklung (entwicklung_at_heubach-edv.de)
Date: Mon 12 May 2003 - 13:08:32 BST


> On Mon, May 12, 2003 at 10:47:59AM +0200, Tor Rune Skoglund wrote:
> > Hi List,
> >
> > E.g to prevent a vserver from accessing the host, and the
> > vserver has it's own IP address, would it be correct and safe
> > to DROP all packet from specific vserver to the host, by
> > iptables -A INPUT -p tcp -s <vserver-local-IP> -j DROP
> > in the host iptables config?
>
> No, local traffic isn't ran through iptables as far as I'm aware.
>
> Regards,
>
> Erik Smit
>

Local traffic *is* run through netfilter.

I just checked this out:

root server: 192.168.0.1
vserver: 192.168.0.2

iptables -I INPUT -s 192.168.0.2 -d 192.168.0.1 -j DROP

-> ssh from vserver to root server doesn't work

iptables -F

--> ssh from vserver to root server works

(Assuming netfilter default policies are ACCEPT)

Regards
Manfred


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 12 May 2003 - 13:48:04 BST by hypermail 2.1.3