About this list Date view Thread view Subject view Author view Attachment view

From: Gilles (gilles_at_harfang.homelinux.org)
Date: Mon 27 Sep 2004 - 01:05:33 BST


> it's still unclear to me what 'simulating the behaviour
> of a physical subnet by a virtual one' means, and of what
> use it would be, maybe giving some examples what you would
> be able to do with that, but currently can't do with the
> vserver networking would be a good idea ...

Maybe it doesn't mean anything...
Well, I said from the start that I might not be using the right
words :-{

It all started with the question of whether it would be possible
to have DMZ servers and "private" servers, all vservers in one
host.
E.g. like so:

        +--------+ +------+
  DMZ | Apache |-----| Exim |------+ +---
        +--------+ +------+ | +----+ /
                                     |----| FW |------| Internet
                                     | +----+ \
        +--------+ +------+ | +---
Private | Mysql |-----| LDAP |------+
        +--------+ +------+ |
                                     |
        +-----+ +-----+ +-----+ |
 Users | A |---| B |---| C |--+
        +-----+ +-----+ +-----+

but where there is one vserver for each of Apache, Exim, Mysql and
LDAP, but all are in a single physical host. FW is another physical
machine where there is a software firewall (maybe in its own vserver,
as you suggested), and A, B, C are end-users physical machines.

In such a case, do we gain something by using "dummy0" and "dummy1" in
order to define 2 different subnets, one for the virtual DMZ and one for
the private servers?
Or is it functionally exactly equivalent to assign them IP adresses in
the same network as all the other physical machines?

> > So: the interface is needed to have connectivity, yet no
> > packets flows through it. Strange, isn't it?
>
> no it's not strange, well, not stranger than the linux
> network stack is ...
>
> you should always keep in mind, addresses ar not interfaces
> and interfaces are not addresses, and routing is something
> completely orthogonal ;)

Can you recommend some good quick-reference that explains
clearly (with examples) why this is not strange?
 
> okay, guess you have to explain what a 'virtual subnet'
> is and why/how this could help containing packets

I guess I had (still have) the wrong picture like the following:
A "real" network would be something like 2 nics (each one having
an interface like "eth0") separated by a wire.
In a "virtual" network only the interfaces remain (no nics or wire)
but it could be functionally equivalent (all the same things can
be done with e.g. "dummy0" as with "eth0").

Sorry to waste your time, I just don't know how absurd it may
sound ;-}

Gilles
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 27 Sep 2004 - 01:03:21 BST by hypermail 2.1.3