Redoing LXC networking at 2 AM has been of a grave consequence.
Timeline
Post
Remote status
Context
2
@plague The tireder I am when I work, the more regretful I am whenever I have to touch it again
@pwm My idea was to have 4 separate isolated subnets for all four instances, another subnet for postgres, one for bloat/privoxy/ebooks bots/etc, one for Tor/I2P/wgproxy daemons with access to Internet. Cut down on socat and NAT masquerading usage, too. Now I have to redo all the routing and iptables rules.
Replies
6
@pwm I am very likely overcomplicating things. Firewall should take care of the containers trying to talk to each other already, methinks.
@pwm Still means I have to redo all the networking stuff.
@pwm >•Tables are merely a concept of nftables to structure the ruleset. They are not relevant to the evaluation of the ruleset.
Well that was a fucking lie otherwise I wouldn't have been locked out.
Well that was a fucking lie otherwise I wouldn't have been locked out.
@pwm I guess that's due to defining `policy drop` in the next table. Lesson learned.
@pwm Nevermind, I still couldn't get NAT to work until moving everything from separate tables into a single one. Oh well.
@plague nedwork is a fug :DDD