Changes

If you will be using connection tracking in any container ip6tables firewall rules (i.e. '-m state --state'), you'll need to enable extra additional kernel modules in the host /etc/vz.conf. Add 'ipt_state' to IPTABLES and 'nf_conntrack_ipv6' to IP6TABLES. They should look something like this: