Subject: Re: [vserver] IPtables, network namespaces
From: Art -kwaak- van Breemen <ard@telegraafnet.nl>
Date: Wed, 28 Mar 2012 15:47:48 +0200

Hi,

On Wed, Mar 21, 2012 at 10:30:22PM +0900, Christian Balzer wrote:
> I believe any host based iptables (as in some client tool messaging
> something on the host to manipulate a client specific iptable) is
> cumbersome at best and prone to abuse at worst.

We have a different view on iptables :-) and customers.
We give each guest their own (multiple) DMZ's. Each DMZ has it's
own network namespace, and it's own network device (just a vlan).
Per DMZ multiple network contexts can exist.
Firewalling is done using an external firewall.
Customers are not capable of doing iptable setups, so they
request with explanation some access, and we either
honour that, come up with a better solution, or deny it with
explanation.
Simple port 80 requests are all going through a transparent
outbound proxy (squid).
We try to deny ftp and honour sftp using Connect method through a
proxy.
Anyway, keeping them tied in prevents a lot of abuse: any exploit
is contained within it's DMZ, so you have to be a real hacker and
not a script to get through ;-) .

Anyway: I think using vserver is worth the pain in this case.

Regards,
Ard