Need basic help with OpehVZ host iptables
I use the following iptables setting on my dedicated server. If I install the OpenVZ kernel, and run the same tables below for host machine, the host machine can no longer resolve dns.
I am trying to run 1 host with 2 openvz containers (each with their own ip address) for private use. I want the host and containers to have their own ip tables. Your help is appreciated.
Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -d 127.0.0.0/8 -j REJECT
Accept all established inbound connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Allow all outbound traffic - you can modify this to only allow certain traffic
iptables -A OUTPUT -j ACCEPT
Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
Allow SSH connections
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
add some custom ports that need to be opened
iptables -A INPUT -p tcp --dport 17711 -j ACCEPT
iptables -A INPUT -p tcp --dport 17712 -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
Log iptables denied calls
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
Reject all other inbound - default deny unless explicitly allowed policy
with the openvz kernel, the following line blocks all outbound traffic from host
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT
ONLY on OpenVZ Head Node This allows access to OpenVZ Containers
iptables -P FORWARD ACCEPT
iptables -F FORWARD
echo "*** outputting the iptables settings before restart "
iptables -L -n
iptables-save | tee /etc/sysconfig/iptables
echo "*** restarting iptables "
service iptables restart
echo "*** outputting the iptables settings after restart "
iptables -L -n