Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is not similar to my earlier post. This is pretty simple I think, I just don't know enough about networking and the ubuntu firewall.

I followed this article and setup a linux container inside my ubuntu server on ec2. I can access the internet from my container.

                       | ----Ubuntu Server on EC2 -----
 ==== INTERNET <==== > |  some magic routes traffic  <===   lxc container
                       |                                    [] 

I needed the internet inside the container only to install dependencies for my app. Now I need to shut off internet access. I wouldn't mind any other approach like prevent a certain user account from the internet.

This is how the network config goes, Any ideas, clues or suggestions on what I should read will be appreciated :

There is a network bridge :

brctl addbr br0
brctl setfd br0 0
ifconfig br0 up

Then I did this:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sysctl -w net.ipv4.ip_forward=1

Then this : cat /etc/dnsmasq.conf

interface = br0
listen-address =
listen-address =
domain = containers
dhcp-range =,,1h

Then : cat etc/dhcp3/dhclient.conf

prepend domain-name-servers;
prepend domain-search "containers.";

Then I ran :

dhclient -e IF_METRIC=100 -pf /var/run/ -lf /var/lib/dhcp/dhclient.eth0.leases eth0

share|improve this question

So I figured it out myself.

I just do :

sysctl -w net.ipv4.ip_forward=0

And voila! :) Of course, if I do ping it resolves the IP for google then fails. So dns still works.

An easy toggle solution for this would be appreciated with votes :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.