Quoting Stéphane Graber ([email protected]): > Signed-off-by: Stéphane Graber <[email protected]>
Huh, thanks for pointing out that I've been using default accept policy which wasn't really what I wanted. Acked-by: Serge E. Hallyn <[email protected]> > --- > config/init/upstart/lxc-net.conf | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/config/init/upstart/lxc-net.conf > b/config/init/upstart/lxc-net.conf > index 517bd2b..3ae3e95 100644 > --- a/config/init/upstart/lxc-net.conf > +++ b/config/init/upstart/lxc-net.conf > @@ -28,6 +28,8 @@ pre-start script > iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp > --dport 67 -j ACCEPT > iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp > --dport 53 -j ACCEPT > iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp > --dport 53 -j ACCEPT > + iptables $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j > ACCEPT > + iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j > ACCEPT > iptables $use_iptables_lock -t nat -D POSTROUTING -s > ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true > iptables $use_iptables_lock -t mangle -D POSTROUTING -o > ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill > ifconfig ${LXC_BRIDGE} down || true > @@ -51,6 +53,8 @@ pre-start script > iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 > -j ACCEPT > iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 53 > -j ACCEPT > iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 > -j ACCEPT > + iptables $use_iptables_lock -I FORWARD -i ${LXC_BRIDGE} -j ACCEPT > + iptables $use_iptables_lock -I FORWARD -o ${LXC_BRIDGE} -j ACCEPT > iptables $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_NETWORK} ! > -d ${LXC_NETWORK} -j MASQUERADE > iptables $use_iptables_lock -t mangle -A POSTROUTING -o ${LXC_BRIDGE} > -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill > > @@ -76,6 +80,8 @@ post-stop script > iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp > --dport 67 -j ACCEPT > iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp > --dport 53 -j ACCEPT > iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp > --dport 53 -j ACCEPT > + iptables $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j > ACCEPT > + iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j > ACCEPT > iptables $use_iptables_lock -t nat -D POSTROUTING -s > ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true > iptables $use_iptables_lock -t mangle -D POSTROUTING -o > ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill > pid=`cat ${varrun}/dnsmasq.pid 2>/dev/null` && kill -9 $pid || > true > -- > 1.9.rc1 > > _______________________________________________ > lxc-devel mailing list > [email protected] > http://lists.linuxcontainers.org/listinfo/lxc-devel _______________________________________________ lxc-devel mailing list [email protected] http://lists.linuxcontainers.org/listinfo/lxc-devel
