About this list Date view Thread view Subject view Author view Attachment view

From: Dennis Roos (dennis_at_intouch.nl)
Date: Mon 27 Sep 2004 - 14:31:55 BST


On Mon, 2004-09-27 at 02:05, Gilles wrote:
> > it's still unclear to me what 'simulating the behaviour
> > of a physical subnet by a virtual one' means, and of what
> > use it would be, maybe giving some examples what you would
> > be able to do with that, but currently can't do with the
> > vserver networking would be a good idea ...
>
> Maybe it doesn't mean anything...
> Well, I said from the start that I might not be using the right
> words :-{
>
> It all started with the question of whether it would be possible
> to have DMZ servers and "private" servers, all vservers in one
> host.
> E.g. like so:
>
> +--------+ +------+
> DMZ | Apache |-----| Exim |------+ +---
> +--------+ +------+ | +----+ /
> |----| FW |------| Internet
> | +----+ \
> +--------+ +------+ | +---
> Private | Mysql |-----| LDAP |------+
> +--------+ +------+ |
> |
> +-----+ +-----+ +-----+ |
> Users | A |---| B |---| C |--+
> +-----+ +-----+ +-----+
>
> but where there is one vserver for each of Apache, Exim, Mysql and
> LDAP, but all are in a single physical host. FW is another physical
> machine where there is a software firewall (maybe in its own vserver,
> as you suggested), and A, B, C are end-users physical machines.

> In such a case, do we gain something by using "dummy0" and "dummy1" in
> order to define 2 different subnets, one for the virtual DMZ and one for
> the private servers?
In the sense of routing/firewalling, you probably will gain something
out of this -
You could create multiple iptables with different default gateways,
per-dummyX-host firewalls, etc.

However anyone connected on the same subnet (physical network, eg. on
the same HUB/SWITCH will be able to sniff all packets traversing the
network.

Personally I would go for 802.1q vlan's, but that's my personal opinion.

> Or is it functionally exactly equivalent to assign them IP adresses in
> the same network as all the other physical machines?
Functionally I think it is the same, the named aliases create by the
vserver-utils will give the same results (If I'm not mistaken).
<SNIP>

> > okay, guess you have to explain what a 'virtual subnet'
> > is and why/how this could help containing packets
>
> I guess I had (still have) the wrong picture like the following:
> A "real" network would be something like 2 nics (each one having
> an interface like "eth0") separated by a wire.
> In a "virtual" network only the interfaces remain (no nics or wire)
> but it could be functionally equivalent (all the same things can
> be done with e.g. "dummy0" as with "eth0").
I gues this means that virtual interfaces are unwired interfaces and
real interfaces are wired :)

> Sorry to waste your time, I just don't know how absurd it may
> sound ;-}
>
> Gilles
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver

-- 
Regards,
Dennis Roos

Network Engineer InTouch N.V. Middenweg 76 1097 BS Amsterdam Tel: +31 (0)20 6752060 Fax: +31 (0)20 6758429

_______________________________________________ Vserver mailing list Vserver_at_list.linux-vserver.org http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 27 Sep 2004 - 14:33:06 BST by hypermail 2.1.3