ipset inside CTs

[Smoke]

kernel-2.6.32-28-pve - ipset works fine inside OpenVZ containers.
kernel-2.6.32-33-pve - ipset fails with 'Kernel error received: Operation not permitted'.
What's happen? Can/would you fix it?

 

[dietmar]

Do you use the new pve firewall feature?

 

[dietmar]

I cannot find any information about ipset inside containers. OpenVZ forum posting

http://forum.openvz.org/index.php?t=msg&goto=49074&

shows that there is no support for that.

I suggest you try to use the new PVE firewall feature instead.

 

[dietmar]

OK, I found the corresponding changelog:

https://openvz.org/Download/kernel/rhel6-testing/042stab093.4/changes

• ve/net/netfilter/ipset: prohibit ipset from the inside CT

So this is disabled for security reasons, see:

https://bugzilla.openvz.org/show_bug.cgi?id=2644

 

[Smoke]

Do you use the new pve firewall feature?

No. My PVEs are visible only from local net. Networking for CTs supplied with VLANs so firewalling totally inside 'em.

 

[dietmar]

No. My PVEs are visible only from local net. Networking for CTs supplies with VLANs so firewalling totally inside 'em.

The PVE firewall also works with VLANs ...

 

[Smoke]

The PVE firewall also works with VLANs ...

Well, looks like I should try it. While IMHO firewall configuration and nfs shares using from within CT much comfortable than with PVE tools.