Just realized private jabber server is also down due to my network shenanigans 
Timeline
Post
Remote status
Context
4Also IP-level filtering doesn't work on a bridge. Apparently I need separate bridge filtering rules.
Setting ports as isolated is another option but then I won't be able to talk to anything but host.
>ipvlan: an ipvlan interface is linked with the interface specified by the lxc.net.[i].link and assigned to the container
>In l3s mode TX processing is very similar to the L3 mode except that iptables (conn-tracking) works in this mode and hence it is L3-symmetric (L3s).
Sounds like a solution, now to figure out what to do with it.
>In l3s mode TX processing is very similar to the L3 mode except that iptables (conn-tracking) works in this mode and hence it is L3-symmetric (L3s).
Sounds like a solution, now to figure out what to do with it.
>IPvlan does not support Network Address Translation (NAT) as it operates at Layer 2 and allows containers to communicate directly with the physical network without the need for NAT. Instead, it provides unique IP addresses to containers while sharing the parent interface's MAC address
Gee thanks, duckduckgo clanker. I have attached it to a dummy interface but it still doesn't work. Redhat docs say I have to do some neighbor setup, but not sure how true is that since I can already ping host from container and vice versa. Will reinvestigate.
Gee thanks, duckduckgo clanker. I have attached it to a dummy interface but it still doesn't work. Redhat docs say I have to do some neighbor setup, but not sure how true is that since I can already ping host from container and vice versa. Will reinvestigate.
Replies
10Might as well ask a (proper) clanker at this point since daytime wageslavery leaves my brain fried enough already.
Tifa-Deepsex-14b-CoT-Q4_K_M did not give a comprehensive answer.
@plague That clanker may be better suited for other sorts of interrogatives
@pwm Qwen seems to be doing something while still fitting into my entry level cards VRAM.
@pwm Anyway, probing br_netfilter and moving port-based rules to forward chain just fucking works, the clanker was right.
@plague all hail the avatar of the Omnissiah
@pwm (rules to accept traffic on host's ports might still have to be in input chain)
Also Husky crashes over 1e+69 symbol limit.