Using NAT for container with private IPs - Revision history

195.214.232.10 at 09:52, 17 August 2016

2016-08-17T09:52:25Z

2015-09-12T23:55:39Z

2015-09-12T22:30:07Z

2015-09-12T22:20:59Z

2015-09-12T22:00:07Z

2015-09-12T21:57:50Z

2015-09-12T21:37:52Z

2015-09-12T21:36:30Z

2015-09-12T21:35:08Z

2015-09-11T14:12:06Z

@@ Line 13: / Line 13: @@
   options nf_conntrack ip_conntrack_disable_ve0=1
-in <code>/etc/modules.conf</code>, <code>/etc/modprobe.conf</code>, or any file under <code>/etc/modprobe.d/</code> (such as <code>/etc/modprobe.d/parallels.conf</code>). '''If there is such a line, please'''
+in <code>/etc/modules.conf</code>, <code>/etc/modprobe.conf</code>, or any file under <code>/etc/modprobe.d/</code> (such as <code>/etc/modprobe.d/vz.conf</code>). '''If there is such a line, please'''
 #change <code>=1</code> to <code>=0</code>
 #reboot the node.

@@ Line 30: / Line 30: @@
 [https://bugs.launchpad.net/ubuntu/+source/procps/+bug/84537 Launchpad]
-The syntax of /etc/sysctl.conf has changed to :
+The syntax of /etc/sysctl.conf has changed to:
 <pre>net.ipv4.conf.default.forwarding=1
 net.ipv4.conf.all.forwarding=1</pre>
-If you use OpenVZ 7/Virtuozzo 7 and want to manage iptables through iptables-services you must disable firewalld and enable iptables.
+===Enable iptables in OpenVZ 7/Virtuozzo 7===
   # systemctl stop firewalld

@@ Line 99: / Line 99: @@
   # iptables -A RH-Firewall-1-INPUT -s 192.168.2.0/24 -j ACCEPT
-−
 === Test ===

@@ Line 6: / Line 6: @@
 === IP conntracks ===
 '''IP connection tracking should be enabled for CT0'''. For recent OpenVZ kernels (2.6.9 and later) connection tracking for CT0 is enabled by default, but it can be disabled by vzctl 4.7 and newer (because it has a negative impact on venet performance, see {{Bug|2755}}). So, make sure there is '''NO''' line like
@@ Line 33: / Line 34: @@
 <pre>net.ipv4.conf.default.forwarding=1
 net.ipv4.conf.all.forwarding=1</pre>
 == How to create the container and attach network properties to it ==
@@ Line 74: / Line 82: @@
   # iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-To save new iptables rules:
+=== Save new iptables rules ===
   # service iptables save
 === Firewall ===
@@ Line 88: / Line 99: @@
   # iptables -A RH-Firewall-1-INPUT -s 192.168.2.0/24 -j ACCEPT
-  # iptables-save > /etc/sysconfig/iptables
 === Test ===

@@ Line 93: / Line 93: @@
 === Test ===
-Now you should be able to reach internet from your container (for Virtuozzo 6 only):
+Now you should be able to reach internet from your container:
-  # vzctl exec $CTID ping openvz.org
+  # prlctl enter 100700
 == How to provide access from Internet to a container ==

@@ Line 34: / Line 34: @@
 net.ipv4.conf.all.forwarding=1</pre>
-== How to provide access for container to Internet ==
+== How to create the container and attach network properties to it ==
-To enable the [[container]]s, which have only internal IP addresses, to access the Internet, SNAT (Source Network Address Translation, also known as IP masquerading) should be configured on the [[Hardware Node]]. This is ensured by the standard Linux <tt>iptables</tt> utility. To perform a simple SNAT setup, execute the following command on the [[Hardware Node]]:
+Create the container:
 <pre>
 # iptables -t nat -A POSTROUTING -s src_net -o eth0 -j SNAT --to ip_address
@@ Line 53: / Line 70: @@
 </pre>
-Or you can use:
+Or you can just use:
   # iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
@@ Line 73: / Line 90: @@
   # iptables-save > /etc/sysconfig/iptables
   # service iptables restart
 === Test ===
-Now you should be able to reach internet from your container:
+Now you should be able to reach internet from your container (for Virtuozzo 6 only):
   # vzctl exec $CTID ping openvz.org

@@ Line 14: / Line 14: @@
 in <code>/etc/modules.conf</code>, <code>/etc/modprobe.conf</code>, or any file under <code>/etc/modprobe.d/</code> (such as <code>/etc/modprobe.d/parallels.conf</code>). '''If there is such a line, please'''
 #change <code>=1</code> to <code>=0</code>
-#Reboot the node.
+#reboot the node.
 === IP forwarding ===
@@ Line 52: / Line 52: @@
 # iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to ip_address
 </pre>
 === Firewall ===