[lxc-devel] [PATCH] upstart: Make sure FORWARD is allowed for containers

[Serge Hallyn]

Quoting Stéphane Graber (stgraber at ubuntu.com):
> Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>

Huh, thanks for pointing out that I've been using default accept
policy which wasn't really what I wanted.

Acked-by: Serge E. Hallyn <serge.hallyn at ubuntu.com>

> ---
>  config/init/upstart/lxc-net.conf | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/config/init/upstart/lxc-net.conf b/config/init/upstart/lxc-net.conf
> index 517bd2b..3ae3e95 100644
> --- a/config/init/upstart/lxc-net.conf
> +++ b/config/init/upstart/lxc-net.conf
> @@ -28,6 +28,8 @@ pre-start script
>  		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
>  		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
>  		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
> +		iptables $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j ACCEPT
> +		iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
>  		iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true
>  		iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
>  		ifconfig ${LXC_BRIDGE} down || true
> @@ -51,6 +53,8 @@ pre-start script
>  	iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
>  	iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
>  	iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
> +	iptables $use_iptables_lock -I FORWARD -i ${LXC_BRIDGE} -j ACCEPT
> +	iptables $use_iptables_lock -I FORWARD -o ${LXC_BRIDGE} -j ACCEPT
>  	iptables $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
>  	iptables $use_iptables_lock -t mangle -A POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
>  
> @@ -76,6 +80,8 @@ post-stop script
>  		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
>  		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
>  		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
> +		iptables $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j ACCEPT
> +		iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
>  		iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true
>  		iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
>  		pid=`cat ${varrun}/dnsmasq.pid 2>/dev/null` && kill -9 $pid || true
> -- 
> 1.9.rc1
> 
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel