From: Dennis Roos (dennis_at_intouch.nl)
Date: Mon 27 Sep 2004 - 14:31:55 BST
On Mon, 2004-09-27 at 02:05, Gilles wrote:
> > it's still unclear to me what 'simulating the behaviour
> > of a physical subnet by a virtual one' means, and of what
> > use it would be, maybe giving some examples what you would
> > be able to do with that, but currently can't do with the
> > vserver networking would be a good idea ...
>
> Maybe it doesn't mean anything...
> Well, I said from the start that I might not be using the right
> words :-{
>
> It all started with the question of whether it would be possible
> to have DMZ servers and "private" servers, all vservers in one
> host.
> E.g. like so:
>
> +--------+ +------+
> DMZ | Apache |-----| Exim |------+ +---
> +--------+ +------+ | +----+ /
> |----| FW |------| Internet
> | +----+ \
> +--------+ +------+ | +---
> Private | Mysql |-----| LDAP |------+
> +--------+ +------+ |
> |
> +-----+ +-----+ +-----+ |
> Users | A |---| B |---| C |--+
> +-----+ +-----+ +-----+
>
> but where there is one vserver for each of Apache, Exim, Mysql and
> LDAP, but all are in a single physical host. FW is another physical
> machine where there is a software firewall (maybe in its own vserver,
> as you suggested), and A, B, C are end-users physical machines.
> In such a case, do we gain something by using "dummy0" and "dummy1" in
> order to define 2 different subnets, one for the virtual DMZ and one for
> the private servers?
In the sense of routing/firewalling, you probably will gain something
out of this -
You could create multiple iptables with different default gateways,
per-dummyX-host firewalls, etc.
However anyone connected on the same subnet (physical network, eg. on
the same HUB/SWITCH will be able to sniff all packets traversing the
network.
Personally I would go for 802.1q vlan's, but that's my personal opinion.
> Or is it functionally exactly equivalent to assign them IP adresses in
> the same network as all the other physical machines?
Functionally I think it is the same, the named aliases create by the
vserver-utils will give the same results (If I'm not mistaken).
<SNIP>
> > okay, guess you have to explain what a 'virtual subnet'
> > is and why/how this could help containing packets
>
> I guess I had (still have) the wrong picture like the following:
> A "real" network would be something like 2 nics (each one having
> an interface like "eth0") separated by a wire.
> In a "virtual" network only the interfaces remain (no nics or wire)
> but it could be functionally equivalent (all the same things can
> be done with e.g. "dummy0" as with "eth0").
I gues this means that virtual interfaces are unwired interfaces and
real interfaces are wired :)
> Sorry to waste your time, I just don't know how absurd it may
> sound ;-}
>
> Gilles
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
-- Regards, Dennis RoosNetwork Engineer InTouch N.V. Middenweg 76 1097 BS Amsterdam Tel: +31 (0)20 6752060 Fax: +31 (0)20 6758429
_______________________________________________ Vserver mailing list Vserver_at_list.linux-vserver.org http://list.linux-vserver.org/mailman/listinfo/vserver