OpenVZ Forum


Home » Mailing lists » Users » Filter container traffic
Re: [Devel] Filter container traffic [message #47009 is a reply to message #46858] Wed, 27 June 2012 08:36 Go to previous messageGo to previous message
kir is currently offline  kir
Messages: 1645
Registered: August 2005
Location: Moscow, Russia
Senior Member
On 06/19/2012 06:10 AM, cheetah wrote:
> Hi Guys,
>
>
> I just setup my openvz environment. What I need to do now is to write
> a firewall to check each flow from container and decide if it is allowed.
>
> I noticed that for each container there is vmnet device.

You probably mean venet or veth. We do not have vmnet.

> I am wondering can I use open vswitch with this vmnet device?

It will be possible later, we have just finished porting OpenVSwitch to
our RHEL6 kernel. Now, it is not possible.

> (It seems not from what is mentioned here
> http://wiki.openvz.org/Virtual_network_device). If not, does that mean
> I have to use netfilter/contrack/iptables to implement my firewall?

Yes, you can use iptables. For venet case, you can use iptables on the
host system and/or inside CT. For veth case, you can only use iptables
inside containers (and on the host you can use ebtables I guess).

Kir Kolyshkin
http://static.openvz.org/userbars/openvz-developer.png

Report message to a moderator

[Message index]
 
Read Message
Read Message
Read Message
Read Message
Read Message
Previous Topic: funtoo openvz images fails to work with "vzctl enter"
Next Topic: CT migration of ploop failed on nfs
Goto Forum:
  

[ Syndicate this forum (XML) ] [ RSS ] [ PDF ]

Current Time: Wed Feb 04 09:31:11 GMT 2026

Total time taken to generate the page: 0.75103 seconds
Powered by FUDforum Powered by Virtuozzo Containers