0

I'm trying to block outbound traffic to certain IP Addresses from within OpenVZ containers. The host node has a list of IP addresses setup using ipset.

The host node itself is succesfully blocking access to the ip, as can be seen when pinging one of the blocked IP addresses

[root@node0019 ecm]# ping 104.27.131.137
PING 104.27.131.137 (104.27.131.137) 56(84) bytes of data.
ping: sendmsg: Operation not permitted
ping: sendmsg: Operation not permitted
^C
--- 104.27.131.137 ping statistics ---
2 packets transmitted, 0 received, 100% packet loss, time 1388ms

but when pinging from the container it responds

root@ct100:/# ping 104.27.131.137
PING 104.27.131.137 (104.27.131.137) 56(84) bytes of data.
64 bytes from 104.27.131.137: icmp_seq=1 ttl=58 time=26.7 ms
64 bytes from 104.27.131.137: icmp_seq=2 ttl=58 time=26.6 ms
^C
--- 104.27.131.137 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 26.692/26.703/26.714/0.011 ms

To block the IP I setup a list of blocked addresses using ipset and then use match-set with the below command

iptables -I OUTPUT -m set --match-set blocklist01 dst -j DROP

My assumption is that it's not being blocked because I'm not targeting the source of the data.

All of the containers connect to the internet through NAT on the host. They are assigned an internal IP address on the host node only. The host node has a single IP address for all the container traffic.

Any advice would be really appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.