From: Stéphane Graber <stgraber@ubuntu.com>
Date: Thu, 30 Jan 2014 14:29:58 +0000 (+0000)
Subject: upstart: Make sure FORWARD is allowed for containers
X-Git-Tag: lxc-1.0.0.beta4~44
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b2a3f33ec176218ed33a9963380fe005a973109d;p=thirdparty%2Flxc.git

upstart: Make sure FORWARD is allowed for containers

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
---

diff --git a/config/init/upstart/lxc-net.conf b/config/init/upstart/lxc-net.conf
index 517bd2b80..3ae3e95c3 100644
--- a/config/init/upstart/lxc-net.conf
+++ b/config/init/upstart/lxc-net.conf
@@ -28,6 +28,8 @@ pre-start script
 		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
 		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
 		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
+		iptables $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j ACCEPT
+		iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
 		iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true
 		iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
 		ifconfig ${LXC_BRIDGE} down || true
@@ -51,6 +53,8 @@ pre-start script
 	iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
 	iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
 	iptables $use_iptables_lock -I INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
+	iptables $use_iptables_lock -I FORWARD -i ${LXC_BRIDGE} -j ACCEPT
+	iptables $use_iptables_lock -I FORWARD -o ${LXC_BRIDGE} -j ACCEPT
 	iptables $use_iptables_lock -t nat -A POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE
 	iptables $use_iptables_lock -t mangle -A POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
 
@@ -76,6 +80,8 @@ post-stop script
 		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 67 -j ACCEPT
 		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p udp --dport 53 -j ACCEPT
 		iptables $use_iptables_lock -D INPUT -i ${LXC_BRIDGE} -p tcp --dport 53 -j ACCEPT
+		iptables $use_iptables_lock -D FORWARD -i ${LXC_BRIDGE} -j ACCEPT
+		iptables $use_iptables_lock -D FORWARD -o ${LXC_BRIDGE} -j ACCEPT
 		iptables $use_iptables_lock -t nat -D POSTROUTING -s ${LXC_NETWORK} ! -d ${LXC_NETWORK} -j MASQUERADE || true
 		iptables $use_iptables_lock -t mangle -D POSTROUTING -o ${LXC_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
 		pid=`cat ${varrun}/dnsmasq.pid 2>/dev/null` && kill -9 $pid || true