Subject: Re: [vserver] netfilter connection tracking
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 18 Apr 2018 16:51:28 +0200

On Wed, Apr 18, 2018 at 01:27:19PM +0200, Christoph Pleger wrote:
> Hello,

> On a real host, I have two vservers running with their own     
> respective network namespaces, like described on               
> http://linux-vserver.org/util-vserver:SplitSharedNetworks.

> On both vservers, I created IP filter rules using nftables/nft.
> But unfortunately, though all "normal" filter rules are working
> as desired, rules that need connection tracking helpers, like
> ftp and tftp, do not - some ip packets are blocked, though they
> should not be blocked. A check an a real machine gave correct
> results.

Network namespaces are a mainline feature (i.e. nothing
Linux-VServer specific) so you should be able to test
them on a 'normal' machine and they should work the same
in a guest (without IP isolation) utilizing network
namespaces.

> So, it is probable that there are some restrictions in using   
> connection tracking helpers inside vservers. 

As far as I know those are part of the kernel not userspace
so they should not be affected by the user space restrictions
or isolation itself.

> Does anybody here know about such restrictions? 

> And is it  possible to workaround them, maybe by adding a                 
> capability to the vserver?

If there are userspace processes involved, you might want
to try to simply give all capabilities to a guest just to
verify, in which case there will be no restrictions compared
to the host.

Hope this helps,
Herbert

> Regards
>     Christoph