[vserver] netfilter connection tracking

From: Christoph Pleger <christoph.pleger_at_cs.uni-dortmund.de>
Date: Wed 18 Apr 2018 - 12:27:19 BST
Message-ID: <5ab5ccea5d30aa1e0e72ddbad6f9484b@cs.uni-dortmund.de>

Hello,

On a real host, I have two vservers running with their own respective
network namespaces, like described on
http://linux-vserver.org/util-vserver:SplitSharedNetworks.

On both vservers, I created IP filter rules using nftables/nft. But
unfortunately, though all "normal" filter rules are working as desired,
rules that need connection tracking helpers, like ftp and tftp, do not -
some ip packets are blocked, though they should not be blocked. A check
an a real machine gave correct results.

So, it is probable that there are some restrictions in using connection
tracking helpers inside vservers. Does anybody here know about such
restrictions? And is it possible to workaround them, maybe by adding a
capability to the vserver?

Regards
     Christoph
Received on Wed Apr 18 12:22:38 2018

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 18 Apr 2018 - 12:22:38 BST by hypermail 2.1.8