I'm trying to block outbound traffic to certain IP Addresses from within OpenVZ containers. The host node has a list of IP addresses setup using ipset.
The host node itself is succesfully blocking access to the ip, as can be seen when pinging one of the blocked IP addresses
[root@node0019 ecm]# ping 184.108.40.206 PING 220.127.116.11 (18.104.22.168) 56(84) bytes of data. ping: sendmsg: Operation not permitted ping: sendmsg: Operation not permitted ^C --- 22.214.171.124 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 1388ms
but when pinging from the container it responds
root@ct100:/# ping 126.96.36.199 PING 188.8.131.52 (184.108.40.206) 56(84) bytes of data. 64 bytes from 220.127.116.11: icmp_seq=1 ttl=58 time=26.7 ms 64 bytes from 18.104.22.168: icmp_seq=2 ttl=58 time=26.6 ms ^C --- 22.214.171.124 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 26.692/26.703/26.714/0.011 ms
To block the IP I setup a list of blocked addresses using ipset and then use match-set with the below command
iptables -I OUTPUT -m set --match-set blocklist01 dst -j DROP
My assumption is that it's not being blocked because I'm not targeting the source of the data.
All of the containers connect to the internet through NAT on the host. They are assigned an internal IP address on the host node only. The host node has a single IP address for all the container traffic.
Any advice would be really appreciated.