Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can you use IPTables on the host node or does that effect all the containers on the node?

I am unsure as to if using iptables will effect all the containers below or not.

share|improve this question
up vote 1 down vote accepted

You can setup iptables on the openvz host, however it is like running an external firewall for the containers.

Any packet must pass through the hosts iptables before reaching the containers.

You can also run iptables on the containers themselves if you add the following to the /etc/vz/vz.conf on the host:

IPTABLES=”ipt_REJECT ipt_recent ipt_owner ipt_REDIRECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp”

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.