I have a server hosting OpenVZ containers. An IPsec tunnel is configured on the hardware node (HN) and I'd like to make the remote network available in the containers (CT). How can I do this?

The current setup is like this:

  • HN has a public address on eth0
  • HN has a private address on the alias eth0:0
  • The remote network is, HN is able to ping hosts on this network
  • CT has a public address on venet0, it is reachable from the outside world and can reach external hosts
  • CT has a private address It can ping its HN on the private address
  • No firewall is configured

CT can't reach hosts on the remote network and I'm not sure how to do this. Can this be done by using a venet interface for the containers, or do I have to switch to veth? Is this a missing route on the HN? Do I have to enable some kind of NATing on the HN?

Any help will be appreciated.

UPDATE: If the CT send a ping from its private address I can see the icmp request/reply with a tcpdump on the venet0 interface on the host. I looks like the outgoing traffic is fine but the incoming traffic is blocked.


To make the host's IPsec tunnels available to your containers, you need to run this in your container :

sysctl -w net.ipv4.conf.venet0.disable_policy=1

This will disable the IPSEC policy (SPD) checks on the VZ's interface. This needs to be adapt if veth devices are used in the container.

For more details see:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.