Iptables – openvz and iptables

iptablesopenvz

http://wiki.openvz.org/Setting_up_an_iptables_firewall mentions to load xt_state before starting a container in order to run iptables in containers. so I ran modprobe xt_state on the host and restarted the container and it worked great. To make this persist I added xt_state to /etc/modules.

The problem is when I restart the physical node the containers iptables wont work unless I manually restart the container, at which point it'll work again. lsmod shows that xt_state is loaded. anyone know why my containers iptables won't work until I manually restart the container?

Best Answer

To me it looks like module is not loaded before ovz containers are started. Since you are using /etc/modules, i guess you are using Debian. I have no ovz host on Debian, but I would check if the modules are really loaded before ovz is started, maybe even load them explicitly in ovz startup script, just to be sure.

Related Solutions

Ubuntu – NFS4 client within OpenVZ container running Ubuntu 11.10

Later versions of OpenVZ do support NFS4 in container. We are using the latest CentOS 6.2 together with the latest stable OpenVZ release 2.6.32-042stab053.5 and NFS4 do work well for us.

Centos – puppet service not stopping service (iptables)

I wanted to leave this here as an answer to my question because it worked for me. If you are running CentOS 5.4 this will work and effectively will ensure that the iptables module is unloaded from the kernel. I will ask a new question specifically relating to my continued work with CentOS 6 and puppet.

exec { "chkconfig_iptables":
          onlyif => "/sbin/chkconfig --level 3 iptables",
          command => "/sbin/chkconfig --level 3 iptables off",
          before => exec["kill_iptables"]
     }
exec { "kill_iptables":
          onlyif => "/sbin/lsmod | grep ip_tables",
          command => "/sbin/service iptables stop;/sbin/modprobe -f -r ip_tables"
      }

Best Answer

Related Solutions

Ubuntu – NFS4 client within OpenVZ container running Ubuntu 11.10

Centos – puppet service not stopping service (iptables)

Related Topic