Subject: netfilter connection tracking
From: Christoph Pleger <christoph.pleger@cs.uni-dortmund.de>
Date: Wed, 18 Apr 2018 13:27:19 +0200

Hello,

On a real host, I have two vservers running with their own respective 
network namespaces, like described on 
http://linux-vserver.org/util-vserver:SplitSharedNetworks.

On both vservers, I created IP filter rules using nftables/nft. But 
unfortunately, though all "normal" filter rules are working as desired, 
rules that need connection tracking helpers, like ftp and tftp, do not - 
some ip packets are blocked, though they should not be blocked. A check 
an a real machine gave correct results.

So, it is probable that there are some restrictions in using connection 
tracking helpers inside vservers. Does anybody here know about such 
restrictions? And is it possible to workaround them, maybe by adding a 
capability to the vserver?

Regards
     Christoph