I would defiantly suggest looking into a DNAT setup on the hardware node.
Here is my working setup (with a few things obfuscated):
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# DHCP
-A INPUT -i vzpb -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT
-A OUTPUT -o vzpb -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT
# Allow ping to and from
-A INPUT -p icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp --icmp-type 0 -j ACCEPT
-A OUTPUT -p icmp --icmp-type 0 -j ACCEPT
-A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
# All new DROP
-A INPUT -m state --state NEW -j REJECT
-A OUTPUT -m state --state NEW -j REJECT
# All non-tcp DROP
-A INPUT ! -p tcp -j REJECT
-A OUTPUT ! -p tcp -j REJECT
# username xsmith = 1234 (XX State University)
#-A INPUT -m owner --uid-owner 1234 -j REJECT
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# SNAT (to give Internet access for the local containers)
-A POSTROUTING -p tcp -o vzpb -j SNAT --to-source 1.2.3.4
# upd is needed for DNS
-A POSTROUTING -p udp -o vzpb -j SNAT --to-source 1.2.3.4
# DNAT SSH
-A PREROUTING -p tcp -d 1.2.3.4 --dport 22 -j DNAT --to-destination 192.168.1.2
# SNAT --to-source NOT required
# DNAT Web
-A PREROUTING -p tcp -d 1.2.3.4 --dport 80 -j DNAT --to-destination 192.168.1.3
-A POSTROUTING -p tcp -d 192.168.1.2 --dport 80 -j SNAT --to-source 192.168.1.1
# --to-source required
COMMIT
- Hardware node public: 1.2.3.4
- Hardware node local: 192.168.1.1
- Container local: 192.168.1.2
- You will probably need to remove all the "-o vzpb" and "-i vzpb" because I have veth and you probably have the default venet (please read http://wiki.openvz.org/Differences_between_venet_and_veth)
Also, put this into you hardware nodes's /etc/sysctl.conf and run sysctl -p
:
### OpenVZ settings (2011-01-25)
# from http://wiki.openvz.org/VEs_and_HNs_in_different_subnets
# On Hardware Node we generally need packet
# forwarding enabled and proxy arp disabled
net.ipv4.conf.default.forwarding=1
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.ip_forward=1
# Enables source route verification
net.ipv4.conf.all.rp_filter = 1
# Enables the magic-sysrq key
kernel.sysrq = 1
# TCP Explict Congestion Notification
net.ipv4.tcp_ecn = 0
# we do not want all our interfaces to send redirects
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0
Option 2
To go even more flexible and secure, consider removing all public IPs from the hardware node and putting the above NAT configuration into a container dedicated to the purpose of NAT only. That container will need a public IP (that can be the only Public IP on that machine).
The NAT container will need MAC-level access to the public network interface so you will need to switch from VENET to VETH:
http://wiki.openvz.org/Differences_between_venet_and_veth
NOTE: veth can be very secure if you firewall your bridge(s) correctly.
To do veth you would have to read this page a lot:
http://wiki.openvz.org/Veth