Subject: Re: [vserver] vservers and policy routing - stopping access to other vserver's local IPs
From: "Phil Stoneman" <pstoneman@gmail.com>
Date: Fri, 7 Nov 2008 15:26:15 +0000

On Fri, Nov 7, 2008 at 13:51, Rik Bobbaers <rik@enzoverder.be> wrote:
> i had similar "problems". how i fixed it? with pre-start and post-stop
> stuff, that adds/removes routes/routing tables on the fly
> also you can do guestbased firewalling and not allow access from certain
> ip addresses to others, independent of interface. so just make a "guest
> firewall" script without specifying interfaces (drop loopback traffic if
> you dont want ANY communication between guests to be possible)

Mmm, I did think about this. The only trouble it gives is that in our
situation, we want to permit some communication, we just want it to go
via the external firewall that sits between vlans. I guess we could
just copy the main firewall's rules on the vserver, but that's
duplication of effort and could leave us open to human error...