On Tue, 2016-06-07 at 02:30 +0000, Sebastián Maruca via Containers wrote: > Hi to everyone! > Is it possible to deploy a "central" iptables ruleset at a Host,and > then, deploy several "isolated" iptables rulesets, one for each > container? > I'd like to have a this "central" iptables to chain basic rules,and > each one of them have trivial rulesets, so as to speak of a"multi > -tenant" IPTables. It depends what you mean by "deploy". Firewall rule sets are 1:1 with network namespaces, so it isn't possible to "inherit" rules from the parent netns. It is, however, perfectly possible to run a veth pair between two different netns and apply different firewall rules on each end with each rule set being in its own netns. It sounds like this could cover your use case. James _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
