<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'>Hi<br><br>I am experimenting with Ubuntu 12.04.1 LTS, apt installed lxc 0.7.5 and shorewall 4.5.8.1 installed from packages on the shorewall site.<br><br>Shorewall is installed on the container and the lxc host. The lxc container is also Ubuntu 12.04.1, installed using lxc-create.<br><br>Shorewall on the container works perfectly and I have no problems there. However, as soon as I start up the Shorewall firewall on the host, routing on the containers breaks. Even stopping Shorewall and running "shorewall clean" does not restore connectivity to the containers (rebooting the host works, and I haven't configured shorewall on the host to auto start yet). I am using the two interface sample files from the Shorewall installation sources.<br><br><span style="font-weight: bold;">Sample of the interfaces file:</span><br>FORMAT 2<br>###############################################################################<br>#ZONE INTERFACE OPTIONS<br>net eth0 dhcp,tcpflags,nosmurfs,routefilter,logmartians,sourceroute=0<br>loc lxcbr0 routeback,bridge,tcpflags,nosmurfs,logmartians<br><br><span style="font-weight: bold;">Sample of the policy file:</span><br>#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST<br><br>loc net ACCEPT<br>fw net ACCEPT<br>net all DROP info<br># THE FOLLOWING POLICY MUST BE LAST<br>all all REJECT info<br><br><span style="font-weight: bold;">Sample of the rules file:</span><br>#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER<br># PORT PORT(S) DEST LIMIT GROUP<br>#SECTION ALL<br>#SECTION ESTABLISHED<br>#SECTION RELATED<br>SECTION NEW<br><br># Don't allow connection pickup from the net<br>#<br>Invalid(DROP) net all tcp<br>#<br># Accept DNS connections from the firewall to the network<br>#<br>DNS(ACCEPT) $FW net<br>DNS(ACCEPT) loc $FW<br>#<br># Accept SSH connections from the local network for administration<br>#<br>#SSH(ACCEPT) loc $FW<br>SSH(ACCEPT) net $FW<br>#<br># Allow Ping from the local network<br>#<br>Ping(ACCEPT) loc $FW<br><br>#<br># Drop Ping from the "bad" net zone.. and prevent your log from being flooded..<br>#<br><br>Ping(DROP) net $FW<br><br>ACCEPT loc $FW udp 67<br>ACCEPT loc $FW udp 68<br>ACCEPT $FW loc udp 67<br>ACCEPT $FW loc udp 68<br><br>ACCEPT $FW loc icmp<br>ACCEPT $FW net icmp<br>#<br><br>Regards<br>Nelson Pascoal<br></div></body></html>