Subject: Re: [vserver] 3 basic questions
From: Ed W <lists@wildgooses.com>
Date: Mon, 10 Aug 2009 00:38:27 +0100

Michael wrote:
> Is it possible to use iptables in VPS?
> The only part that holds me into openvz.
>
> I need to use iptables inside VPS not on the host.
>
>   

Someone else will no doubt correct me, but as I understand it you can 
grant any guest any capability you wish, including the ability to fart 
with the network stack.  However, obviously any guest which can run 
iptables can implicitly also take down the network card and potentially 
cause problems for other instances sharing that card (ie the network 
stack ain't virtualised)

If this isn't a problem I think you just grant your image a capabilities 
flag and off you go?

Another option would be to setup some kind of IPC back to the host and 
that would then vet the iptables options and implement them on your 
behalf... I think this has been discussed in more oblique forms before, 
but not sure how easy it would be to google for these threads... 
(perhaps on "ipc"?)

I think a final issue is that the vservers appear to iptables as local 
processes (which they are) and this has certain implications for the way 
you need to use iptables which are a bit peculiar and catch a bunch of 
folks out.  Basically stuff doesn't go through the forward chain like 
you might expect, but only sits on the INPUT (or something like that??)

Good luck

Ed W