This is quick analysis.
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
3595 331K eth0_fwd all -- eth0 * 0.0.0.0/0 0.0.0.0/0
4006 2992K venet0_fwd all -- venet0 * 0.0.0.0/0 0.0.0.0/0
0 0 eth1_fwd all -- eth1 * 0.0.0.0/0 0.0.0.0/0
0 0 Reject all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 6 prefix `Shorewall:FORWARD:REJECT:'
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
You can see the string "Shorewall:FORWARD:REJECT" - that is what in your error message, thus packets are droped here. Therefore the packet isn't catched by the rule "venet0_fwd". Look at it:
Chain venet0_fwd (1 references)
pkts bytes target prot opt in out source destination
199 15876 dynamic all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID,NEW
4006 2992K venet2all all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 venet2all all -- * eth1 0.0.0.0/0 0.0.0.0/0
Really! out equals eth0 and eth1, but in our case, when two VEs speake, out must equals venet0 too.
OpenVZ Forum
Members
Search
Help
Register
Login
Home
