Re: [vserver] IPtables, network namespaces

From: Eugen Leitl <eugen_at_leitl.org>
Date: Wed 21 Mar 2012 - 13:37:11 GMT
Message-ID: <20120321133711.GY9891@leitl.org>

On Wed, Mar 21, 2012 at 10:30:22PM +0900, Christian Balzer wrote:
>
> Hello,
>
> Every once in a while (actually more frequent than that) the need for
> iptables in a guest creeps up. And I'm not just talking about cases where
> people want to use iptables because it's the only hammer they know beat
> packets into submission.
>
> Scouring this ML finds only a few mentions, most of them completely
> outdated and I'm happy that I at least remembered reading about this more
> than 2.5 years ago and coming up with the net namespaces search string as
> well.
>
> I believe any host based iptables (as in some client tool messaging
> something on the host to manipulate a client specific iptable) is
> cumbersome at best and prone to abuse at worst.
> Given the functionality of net namespaces, has anybody in the past 2.5
> years successfully used this with Vservers to set up fully functional
> client network interface? Care to share your knowledge/experiences?
>
> No trace of this in util-vserver for now, AFAIK.

If you want to use iptables in the guest you have to emulate the
whole network stack which leaves you with LHC or similar.
Received on Wed Mar 21 13:37:20 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 21 Mar 2012 - 13:37:20 GMT by hypermail 2.1.8