OpenVZ Host Node and IPTables

Question

Can you use IPTables on the host node or does that effect all the containers on the node?

I am unsure as to if using iptables will effect all the containers below or not.

Answer 1

You can setup iptables on the openvz host, however it is like running an external firewall for the containers.

Any packet must pass through the hosts iptables before reaching the containers.

You can also run iptables on the containers themselves if you add the following to the /etc/vz/vz.conf on the host:

IPTABLES=”ipt_REJECT ipt_recent ipt_owner ipt_REDIRECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp”