Hello,
On a real host, I have two vservers running with their own respective
network namespaces, like described on
http://linux-vserver.org/util-vserver:SplitSharedNetworks.
On both vservers, I created IP filter rules using nftables/nft. But
unfortunately, though all "normal" filter rules are working as desired,
rules that need connection tracking helpers, like ftp and tftp, do not -
some ip packets are blocked, though they should not be blocked. A check
an a real machine gave correct results.
So, it is probable that there are some restrictions in using connection
tracking helpers inside vservers. Does anybody here know about such
restrictions? And is it possible to workaround them, maybe by adding a
capability to the vserver?
Regards
Christoph
Received on Wed Apr 18 12:22:38 2018