On Wed, Mar 21, 2012 at 10:30:22PM +0900, Christian Balzer wrote:
>
> Hello,
>
> Every once in a while (actually more frequent than that) the need for
> iptables in a guest creeps up. And I'm not just talking about cases where
> people want to use iptables because it's the only hammer they know beat
> packets into submission.
>
> Scouring this ML finds only a few mentions, most of them completely
> outdated and I'm happy that I at least remembered reading about this more
> than 2.5 years ago and coming up with the net namespaces search string as
> well.
>
> I believe any host based iptables (as in some client tool messaging
> something on the host to manipulate a client specific iptable) is
> cumbersome at best and prone to abuse at worst.
> Given the functionality of net namespaces, has anybody in the past 2.5
> years successfully used this with Vservers to set up fully functional
> client network interface? Care to share your knowledge/experiences?
>
> No trace of this in util-vserver for now, AFAIK.
If you want to use iptables in the guest you have to emulate the
whole network stack which leaves you with LHC or similar.