> Anything that inserts itself into iptables feels like a no no. I have a setup which works great with VirtualBox. I have pfSense installed in a guest VM and t

> Anything that inserts itself into iptables feels like a no no. I have a setup which works great with VirtualBox. I have pfSense installed in a guest VM and the host machine routes through it -- without that guest VM running the host machine can't connect anywhere. It's really handy to have a consistent firewall interface despite every host OS having a different idea of what a firewall should do or look like. Docker works with the VirtualBox setup too. I tried to do the same thing with libvirt for four weekends and eventually gave up. I couldn't get libvirt to play nice with iptables at all. LXC is for containers, of course, instead of VMs. But since Docker works with the VM-guest-as-a-router setup, perhaps I'll really give LXC a try too.