On Mon, Aug 10, 2009 at 07:37:22PM +1200, Michael wrote: > Why not to make something sinmilart to openvz - optiuonallly > emaulte eth? because it already exists in recent kernels ... it is called 'network namespaces' > I think it will make a great improvents to vserver. not really, as basically all things can be done a lot more efficient and with less 'strange effects' on the host (regarding networking) > PS. I like vserver so mush ( but don't have all required skill > to extend it.) emulation of eth will let to use iptaBLES, which can also be done (a lot more securely) with a policy daemon on the host, and a proxy on the guest > VPN, which already runs inside guests, as tun devices can be 'assigned' to a guest as well > DHCPD, which doesn't make much sense in a guest, as it is not at the IP layer (but yeah, that should be possible with network namespaces) > SAMBA,, ETC... which works perfectly fine inside a guest as well so, what would be the big advantage again? note: 95% of the 'virtual networkstack requests' originate from users which want to run a proprietary management panel which is too dumb to work without iptables, so IMHO they can be ignored (i.e. bug the company behind the panel :) so, could you elaborate why you _need_ to run iptables on the host again please? best, Herbert > On Mon, Aug 10, 2009 at 11:38 AM, Ed W<lists@wildgooses.com> wrote: > > Michael wrote: > >> > >> Is it possible to use iptables in VPS? > >> The only part that holds me into openvz. > >> > >> I need to use iptables inside VPS not on the host. > >> > >> > > > > Someone else will no doubt correct me, but as I understand it you can grant > > any guest any capability you wish, including the ability to fart with the > > network stack. However, obviously any guest which can run iptables can > > implicitly also take down the network card and potentially cause problems > > for other instances sharing that card (ie the network stack ain't > > virtualised) > > > > If this isn't a problem I think you just grant your image a capabilities > > flag and off you go? > > > > Another option would be to setup some kind of IPC back to the host and that > > would then vet the iptables options and implement them on your behalf... I > > think this has been discussed in more oblique forms before, but not sure how > > easy it would be to google for these threads... (perhaps on "ipc"?) > > > > I think a final issue is that the vservers appear to iptables as local > > processes (which they are) and this has certain implications for the way you > > need to use iptables which are a bit peculiar and catch a bunch of folks > > out. Basically stuff doesn't go through the forward chain like you might > > expect, but only sits on the INPUT (or something like that??) > > > > Good luck > > > > Ed W > > > > > > -- > -- > Michael