From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Thu 22 Apr 2004 - 00:03:50 BST
On Tue, Apr 20, 2004 at 09:03:22PM -0500, Micah Anderson wrote:
> I've got a vserver whose IP is 192.168.0.1 and another whose is
> 192.168.0.2. I can ping between these two vservers fine, however, I
> tried to setup mysql to connect from .1 to .2 and found that it was
> using the host's actual IP to connect, instead of the private IP:
>
> $ mysqladmin -h 192.168.0.2 ping
> connect to server at '192.168.0.2' failed
> error: 'Host '212.112.147.194' is not allowed to connect to this MySQL
> server'
I did simulate this setup (although not with mysql)
in the folowing way:
HOST# ifconfig eth0 10.0.0.2
HOST# ifconfig eth0:0 192.168.0.1
HOST# ifconfig lo 127.0.0.1
HOST# vserver XXXX start
Starting the virtual server XXXX
Server XXXX is not running
ipv4root is now 192.168.0.2
Host name is now XXXX.test.org
New security context is 1001
...
HOST# vserver YYYY start
Starting the virtual server YYYY
Server YYYY is not running
ipv4root is now 192.168.0.3
Host name is now YYYY.test.org
New security context is 1002
...
... from another host:
REMT# ssh root_at_192.168.0.2
XXXX# lynx http://192.168.0.3
... meanwhile on the host:
HOST# tcpdump lo
21:52:50.693643 0...0 0800 74: 192.168.0.2.1024 > 192.168.0.3.80:
S [tcp sum ok] 3524804485:3524804485(0) win 32767
<mss 16396,sackOK,timestamp 40068 0,nop,wscale 0>
(DF) (ttl 64, id 41729, len 60)
21:52:50.694564 0...0 0800 74: 192.168.0.3.80 > 192.168.0.2.1024:
S [tcp sum ok] 3530576594:3530576594(0) ack 3524804486 win 32767
<mss 16396,sackOK,timestamp 40068 40068,nop,wscale 0>
(DF) (ttl 64, id 0, len 60)
...
so this looks to me as expected ...
here some details about the network info
# ip addr show
1: lo: <LOOPBACK,UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.2/8 brd 10.255.255.255 scope global eth0
inet 192.168.0.1/24 brd 192.168.0.255 scope global eth0:0
inet 192.168.0.2/24 scope global secondary eth0:XXXX
inet 192.168.0.3/24 scope global secondary eth0:YYYY
so I'd suspect either some iptables rule doing that
or some interference between the vserver patch and
some other patch ...
HTH,
Herbert
> I used tcpdump to look at the different interfaces, and it was only
> when I looked at the loopback did I see the traffic happening:
>
> 18:51:54.867738 212.112.147.194.43166 > 192.168.0.2.mysql: S
> 648997658:648997658(0) win 32767 <mss 16396,sackOK,timestamp 88679821
> 0,nop,wscale 0> (DF)
> 18:51:54.867825 192.168.0.2.mysql > 212.112.147.194.43166: S
> 649947611:649947611(0) ack 648997659 win 32767 <mss
> 16396,sackOK,timestamp 88679821 88679821,nop,wscale 0> (DF)
> 18:51:54.867904 212.112.147.194.43166 > 192.168.0.2.mysql: . ack
> 1 win 32767 <nop,nop,timestamp 88679821 88679821> (DF)
> 18:51:54.868663 192.168.0.2.mysql > 212.112.147.194.43166: P
> 1:77(76) ack 1 win 32767 <nop,nop,timestamp 88679822 88679821> (DF)
> [tos 0x8]
> 18:51:54.868740 212.112.147.194.43166 > 192.168.0.2.mysql: . ack
> 77 win 32767 <nop,nop,timestamp 88679822 88679822> (DF)
> 18:51:54.868801 192.168.0.2.mysql > 212.112.147.194.43166: F
> 77:77(0) ack 1 win 32767 <nop,nop,timestamp 88679822 88679822> (DF)
> [tos 0x8]
> 18:51:54.869254 212.112.147.194.43166 > 192.168.0.2.mysql: F
> 1:1(0) ack 78 win 32767 <nop,nop,timestamp 88679822 88679822> (DF)
> [tos 0x8]
> 18:51:54.869305 192.168.0.2.mysql > 212.112.147.194.43166: . ack
> 2 win 32767 <nop,nop,timestamp 88679822 88679822> (DF) [tos 0x8]
>
> How can I make it so that the vserver is communicating with the
> private IP instead of the public one? I want to do this so I can allow
> some vservers the ability to access the mysql, but not others. I can
> simply add 212.112.147.194 to the tables to be able to connect, but
> then all the vservers would be able to connect, when I only want
> 192.168.0.1 to be able to connect, but not 192.168.0.3 for example.
>
> Thanks for any pointers! Here is some more info:
>
> /etc/vservers/db.conf:
> #
> # the vserver which runs the databases
> #
> S_DOMAINNAME="db"
> S_HOSTNAME="db"
> IPROOT="192.168.0.2"
> IPROOTMASK="255.255.255.0"
> IPROOTDEV="eth0"
> S_CAPS="CAP_NET_RAW"
>
> /etc/vservers/zun.conf:
> S_HOSTNAME="zun"
> IPROOT="192.168.0.1"
> IPROOTMASK="255.255.255.0"
> IPROOTDEV="eth0"
> S_FLAGS="lock nproc"
> ULIMIT="-u 256 -n 1024"
> S_CAPS="CAP_NET_RAW"
>
> Thanks!
>
> micah
>
> ----
> "Naturally, the common people don't want war, but after all, it
> is the leaders of a country who determine the policy...Voice or no
> voice, the people can always be brought to the bidding of the leaders.
> This is easy. All you have to do is to tell them they are being
> attacked, and denounce the pacifists for lack of patriotism and
> exposing the country to danger. It works the same in every country."
> -- Goering, Nuremburg trial
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver