Need basic help with OpehVZ host iptables

I use the following iptables setting on my dedicated server. If I install the OpenVZ kernel, and run the same tables below for host machine, the host machine can no longer resolve dns.

I am trying to run 1 host with 2 openvz containers (each with their own ip address) for private use. I want the host and containers to have their own ip tables. Your help is appreciated.

iptables -F

Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0

iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -d 127.0.0.0/8 -j REJECT

Accept all established inbound connections

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Allow all outbound traffic - you can modify this to only allow certain traffic

iptables -A OUTPUT -j ACCEPT

Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).

iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Allow SSH connections

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

add some custom ports that need to be opened

iptables -A INPUT -p tcp --dport 17711 -j ACCEPT iptables -A INPUT -p tcp --dport 17712 -j ACCEPT

Allow ping

iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

Log iptables denied calls

iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

Reject all other inbound - default deny unless explicitly allowed policy

with the openvz kernel, the following line blocks all outbound traffic from host

iptables -A INPUT -j REJECT iptables -A FORWARD -j REJECT

ONLY on OpenVZ Head Node This allows access to OpenVZ Containers

iptables -P FORWARD ACCEPT iptables -F FORWARD

echo "*** outputting the iptables settings before restart " iptables -L -n iptables-save | tee /etc/sysconfig/iptables

echo "*** restarting iptables " service iptables restart

echo "*** outputting the iptables settings after restart " iptables -L -n

http://ift.tt/1dvHQ0Z