Can you use IPTables on the host node or does that effect all the containers on the node?
I am unsure as to if using iptables will effect all the containers below or not.
You can setup iptables on the openvz host, however it is like running an external firewall for the containers.
Any packet must pass through the hosts iptables before reaching the containers.
You can also run iptables on the containers themselves if you add the following to the /etc/vz/vz.conf on the host: