[Users] problem with iptables inside VE

[Sergey Ivanov]

Hi,
I need help with openvz setup.
Here is the problem. In VE I have:
---
# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j LOG --log-prefix "ipt.input: " --log-level 7
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j LOG --log-prefix "ipt.forward: " --log-level 7
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
---
and when I try to ssh to VE, I am failing and in dmesg I see lines about it
like these (I've modified MAC):
---
[ 9343.653892] ipt.input: IN=eth0 OUT=
MAC=00:de:ad:be:af:da:de:ad:be:af:de:ad:be:af SRC=10.0.128.117
DST=10.0.127.53 LEN=60 TOS=0x10 PREC=0x00 TTL=63 ID=1295 DF PROTO=TCP
SPT=48744 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0
---
Immediately after "service iptables stop" I have working ssh service and
can login into VE remotely. I want to do this with iptables.

I use RHEL6 as a HE and tried Fedora-20 downloaded from
http://download.openvz.org/template/precreated/fedora-20-x86.tar.gz. I use
VLANs, trunk is going to physical interface em1, HE has ip address on vlan
128, there are em1.128 interface for it.
Virtual environment has netif, created by
---
vzctl set 12753 --save --netiff-add eth0,,veth12753,,br.127
---
I've set up bridge br.127 for this vlan and with automatically added by
ifcfg scripts em1.127, and
---
EXTERNAL_SCRIPT="/usr/sbin/vznetaddbr"
---
in vznet.conf are adding veth to it. I'm using vzkernel 2.6.32-042stab088.4

-- 
  Regards,
  Sergey Ivanov.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openvz.org/pipermail/users/attachments/20140513/3c1966fb/attachment.html>