Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using a firewall on the HN to open/close the ports of the containers directly from the HN. I'm using the iptables script from the openvz wiki.

Everything works fine but I cannot ssh out from the VPS. I can enter via ssh into the container, but if I try to do an ssh connection from the VPS to another server the firewall blocks it.

What rules should I add the the iptables script to allow the outgoing ssh connection? Here's the script:

# firewall      Start iptables firewall
# chkconfig: 2345 97 87
# description:  Starts, stops and saves iptables firewall
# This script sets up the firewall for the INPUT chain (which is for
# the HN itself) and then processes the config files under
# /etc/firewall.d to set up additional rules in the FORWARD chain
# to allow access to containers' services.

. /etc/init.d/functions

# the IP block allocated to this server
# the IP used by the hosting server itself
# services that should be allowed to the HN;
# services for containers are configured in /etc/firewall.d/*
# hosts allowed full access through the firewall,
# to all containers and to this server

purge() {
  echo -n "Firewall: Purging and allowing all traffic"
  iptables -P OUTPUT ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -P INPUT ACCEPT
  iptables -F
  success ; echo

setup() {
  echo -n "Firewall: Setting default policies to DROP"
  iptables -P INPUT DROP
  iptables -P FORWARD DROP
  iptables -I INPUT   -j ACCEPT -m state --state ESTABLISHED,RELATED
  iptables -I FORWARD -j ACCEPT -m state --state ESTABLISHED,RELATED
  iptables -I INPUT -j ACCEPT -i lo
  iptables -I FORWARD -j ACCEPT --source $SEGMENT
  success ; echo

  echo "Firewall: Allowing access to HN"
  for port in $OKPORTS ; do
    echo -n "          port $port"
    iptables -I INPUT -j ACCEPT -s $SEGMENT -d $THISHOST --protocol tcp --destination-port $port
    iptables -I INPUT -j ACCEPT -s $SEGMENT -d $THISHOST --protocol udp --destination-port $port
    success ; echo
  for ip in $DMZS ; do
    echo -n "          DMZ $ip"
    iptables -I INPUT   -i eth0 -j ACCEPT -s $ip
    iptables -I FORWARD -i eth0 -j ACCEPT -s $ip
    success ; echo

  CTSETUPS=`echo /etc/firewall.d/*`
  if [ "$CTSETUPS" != "/etc/firewall.d/*" ] ; then
  echo "Firewall: Setting up container firewalls"
  for i in $CTSETUPS ; do
    . $i
    echo -n "          $CTNAME CT$CTID"
    if [ -n "$BANNED" ]; then
      for source in $BANNED ;  do iptables -I FORWARD -j DROP --destination $CTIP --source $source ; done
    if [ -n "$OPENPORTS" ]; then
      for port in $OPENPORTS ; do iptables -I FORWARD -j ACCEPT --protocol tcp --destination $CTIP --destination-port $port ; done
      for port in $OPENPORTS ; do iptables -I FORWARD -j ACCEPT --protocol udp --destination $CTIP --destination-port $port ; done
    if [ -n "$DMZS" ]; then
      for source in $DMZS ; do iptables -I FORWARD -j ACCEPT --protocol tcp --destination $CTIP --source $source ; done
      for source in $DMZS ; do iptables -I FORWARD -j ACCEPT --protocol udp --destination $CTIP --source $source ; done
    [ $? -eq 0 ] && success || failure

case "$1" in
    echo "Starting firewall..."
    echo "Stopping firewall..."
    $0 stop
    $0 start
    iptables -n -L
    echo "Usage: $0 <start|stop|restart|status>"

And this is an example of the single container configuration which gets parsed from the firewall script.

# This file is processed by /etc/init.d/firewall
CTID="1"            # the container's ID#
CTNAME="Customer1"      # A human-friendly label for the container
CTIP=""     # the IP address for this container 
OPENPORTS="80 443 22"       # ports that should be universally opened
                # to the entire Internet
DMZS=""    # IPs and blocks that should have full access
                # to the container's services
BANNED=""           # IPs and blocks that should be entirely
                # blocked from the container's services
share|improve this question
up vote 1 down vote accepted

It seems to me that you can solve this problem by creating another file in /etc/firewall.d/ and abusing $CTIP and $DMZS. You just turn them around, making $DMZS the IP of the container and $CTIP the Internet: CTIP=0/0

share|improve this answer
Nice workaround! – Atropo Apr 26 '13 at 10:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.