Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

This question is not similar to my earlier post. This is pretty simple I think, I just don't know enough about networking and the ubuntu firewall.

I followed this article and setup a linux container inside my ubuntu server on ec2. I can access the internet from my container.

                       | ----Ubuntu Server on EC2 -----
 ==== INTERNET <==== > |  some magic routes traffic  <===   lxc container
                       |                                    [192.168.3.1] 
                       |------------------------------

I needed the internet inside the container only to install dependencies for my app. Now I need to shut off internet access. I wouldn't mind any other approach like prevent a certain user account from the internet.

This is how the network config goes, Any ideas, clues or suggestions on what I should read will be appreciated :


There is a network bridge :

brctl addbr br0
brctl setfd br0 0
ifconfig br0 192.168.3.1 up

Then I did this:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sysctl -w net.ipv4.ip_forward=1

Then this : cat /etc/dnsmasq.conf

domain-needed
bogus-priv
interface = br0
listen-address = 127.0.0.1
listen-address = 192.168.3.1
expand-hosts
domain = containers
dhcp-range = 192.168.3.50,192.168.3.200,1h

Then : cat etc/dhcp3/dhclient.conf

prepend domain-name-servers 127.0.0.1;
prepend domain-search "containers.";

Then I ran :

dhclient -e IF_METRIC=100 -pf /var/run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases eth0

share|improve this question
add comment

1 Answer 1

So I figured it out myself.

I just do :

sysctl -w net.ipv4.ip_forward=0

And voila! :) Of course, if I do ping www.google.com it resolves the IP for google then fails. So dns still works.

An easy toggle solution for this would be appreciated with votes :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.