About this list Date view Thread view Subject view Author view Attachment view

From: Hans-Juergen Beie (hjb_at_pollux.franken.de)
Date: Wed 22 Dec 2004 - 11:38:00 GMT


Hi Lars,

> I've tried different configurations, and it seems that I cannot make a fake
> DMZ of vservers within 1 root server?
>
> Reason to do it is that I would like to avoid using all my assigned IP
> addresses on vservers who just run 1 service each.
>
> eth0 is the internet interface which is assigned only 1 public IP
>
> eth1 is the interface of the fake DMZ and has assigned IPs like
> 192.168.250.xxx to vservers running different services.
>
> I use iptables to forward requests to eth0 (public IP) to services on eth1
> (192.168...), but I have no success doing that :(
>
> Is my idea impossible?
>
> If anyone have some example configuration I would really like to see it.
>
> Thanks.

Similar situation here. It tooks me some time to get it running. Finally I
found that 'dummy0' was the solution (don't use any other name!).

Here the interface configs for the mother ship (kernel 2.4.26, vserver-1.27,
debian/woody) ...

# /etc/network/interfaces -- mother system
#
# The loopback interface
auto lo
iface lo inet loopback

# The "physical NIC" (public ip address of the machine)
auto eth0
iface eth0 inet static
        address a.b.c.218
        netmask 255.255.255.224
        network a.b.c.192
        broadcast a.b.c.223
        gateway a.b.c.193

# The "virtual NIC" dummy0 connected to private network (vservers)
#
auto dummy0
iface dummy0 inet static
        address 192.168.99.1
        netmask 255.255.255.0
        network 192.168.99.0
        broadcast 192.168.99.255

... and the vserver(s) ...

# /etc/network/interfaces -- vserver
#
auto eth0
iface eth0 inet static
        address 192.168.99.2
        netmask 255.255.255.0
        network 192.168.99.0
        broadcast 192.168.99.255
        gateway 192.168.99.1

The corresponding vserver config looks like ...

# /etc/vservers/mail.conf
#
IPROOT="192.168.99.2"
IPROOTMASK="255.255.255.0"
IPROOTBCAST="192.168.99.255"

# How shall the networkdevice be named from the view of the vserver
IPROOTDEV="dummy0"

# shown hostname
S_HOSTNAME=mail

The rest (including SNAT, DNAT) to connect the vservers to the outside world
is managaged by iptables on the mother system as usual. I used shorwall for
that, its configuration is clearly arranged.

hjb :-?

_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 22 Dec 2004 - 12:05:20 GMT by hypermail 2.1.3