Subject: Re: [vserver] IPtables, network namespaces
From: Eugen Leitl <eugen@leitl.org>
Date: Wed, 21 Mar 2012 14:37:11 +0100

On Wed, Mar 21, 2012 at 10:30:22PM +0900, Christian Balzer wrote:
> 
> Hello,
> 
> Every once in a while (actually more frequent than that) the need for
> iptables in a guest creeps up. And I'm not just talking about cases where
> people want to use iptables because it's the only hammer they know beat
> packets into submission.
> 
> Scouring this ML finds only a few mentions, most of them completely
> outdated and I'm happy that I at least remembered reading about this more
> than 2.5 years ago and coming up with the net namespaces search string as
> well.
> 
> I believe any host based iptables (as in some client tool messaging
> something on the host to manipulate a client specific iptable) is
> cumbersome at best and prone to abuse at worst.
> Given the functionality of net namespaces, has anybody in the past 2.5
> years successfully used this with Vservers to set up fully functional
> client network interface? Care to share your knowledge/experiences?
> 
> No trace of this in util-vserver for now, AFAIK.

If you want to use iptables in the guest you have to emulate the
whole network stack which leaves you with LHC or similar.