<div dir="ltr">Hi, <div>I need help with openvz setup.</div><div>Here is the problem. In VE I have:</div><div>---</div><div><div># iptables -S</div><div>-P INPUT ACCEPT</div><div>-P FORWARD ACCEPT</div><div>-P OUTPUT ACCEPT</div>
<div>-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT</div><div>-A INPUT -p icmp -j ACCEPT</div><div>-A INPUT -i lo -j ACCEPT</div><div>-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT</div><div>-A INPUT -j LOG --log-prefix "ipt.input: " --log-level 7<br>
</div><div>-A INPUT -j REJECT --reject-with icmp-host-prohibited</div><div>-A FORWARD -j LOG --log-prefix "ipt.forward: " --log-level 7</div><div>-A FORWARD -j REJECT --reject-with icmp-host-prohibited</div></div>
<div>---</div><div>and when I try to ssh to VE, I am failing and in dmesg I see lines about it like these (I've modified MAC):</div><div>---</div><div><div>[ 9343.653892] ipt.input: IN=eth0 OUT= MAC=00:de:ad:be:af:da:de:ad:be:af:de:ad:be:af SRC=10.0.128.117 DST=10.0.127.53 LEN=60 TOS=0x10 PREC=0x00 TTL=63 ID=1295 DF PROTO=TCP SPT=48744 DPT=22 WINDOW=29200 RES=0x00 SYN URGP=0 </div>
</div><div>---</div><div>Immediately after "service iptables stop" I have working ssh service and can login into VE remotely. I want to do this with iptables.</div><div><br></div><div>I use RHEL6 as a HE and tried Fedora-20 downloaded from <a href="http://download.openvz.org/template/precreated/fedora-20-x86.tar.gz">http://download.openvz.org/template/precreated/fedora-20-x86.tar.gz</a>. I use VLANs, trunk is going to physical interface em1, HE has ip address on vlan 128, there are em1.128 interface for it.</div>
<div>Virtual environment has netif, created by </div><div>---</div><div>vzctl set 12753 --save --netiff-add eth0,,veth12753,,br.127<br></div><div>---</div><div>I've set up bridge br.127 for this vlan and with automatically added by ifcfg scripts em1.127, and </div>
<div>---</div><div><div>EXTERNAL_SCRIPT="/usr/sbin/vznetaddbr"</div></div><div>---</div><div>in vznet.conf are adding veth to it. I'm using vzkernel 2.6.32-042stab088.4</div><div><br></div><div>-- </div><div>
Regards,</div><div> Sergey Ivanov.</div><div><br></div><div><br></div></div>