From: Hans-Juergen Beie (hjb_at_pollux.franken.de)
Date: Wed 22 Dec 2004 - 11:38:00 GMT
Hi Lars,
> I've tried different configurations, and it seems that I cannot make a fake
> DMZ of vservers within 1 root server?
>
> Reason to do it is that I would like to avoid using all my assigned IP
> addresses on vservers who just run 1 service each.
>
> eth0 is the internet interface which is assigned only 1 public IP
>
> eth1 is the interface of the fake DMZ and has assigned IPs like
> 192.168.250.xxx to vservers running different services.
>
> I use iptables to forward requests to eth0 (public IP) to services on eth1
> (192.168...), but I have no success doing that :(
>
> Is my idea impossible?
>
> If anyone have some example configuration I would really like to see it.
>
> Thanks.
Similar situation here. It tooks me some time to get it running. Finally I
found that 'dummy0' was the solution (don't use any other name!).
Here the interface configs for the mother ship (kernel 2.4.26, vserver-1.27,
debian/woody) ...
# /etc/network/interfaces -- mother system
#
# The loopback interface
auto lo
iface lo inet loopback
# The "physical NIC" (public ip address of the machine)
auto eth0
iface eth0 inet static
address a.b.c.218
netmask 255.255.255.224
network a.b.c.192
broadcast a.b.c.223
gateway a.b.c.193
# The "virtual NIC" dummy0 connected to private network (vservers)
#
auto dummy0
iface dummy0 inet static
address 192.168.99.1
netmask 255.255.255.0
network 192.168.99.0
broadcast 192.168.99.255
... and the vserver(s) ...
# /etc/network/interfaces -- vserver
#
auto eth0
iface eth0 inet static
address 192.168.99.2
netmask 255.255.255.0
network 192.168.99.0
broadcast 192.168.99.255
gateway 192.168.99.1
The corresponding vserver config looks like ...
# /etc/vservers/mail.conf
#
IPROOT="192.168.99.2"
IPROOTMASK="255.255.255.0"
IPROOTBCAST="192.168.99.255"
# How shall the networkdevice be named from the view of the vserver
IPROOTDEV="dummy0"
# shown hostname
S_HOSTNAME=mail
The rest (including SNAT, DNAT) to connect the vservers to the outside world
is managaged by iptables on the mother system as usual. I used shorwall for
that, its configuration is clearly arranged.
hjb :-?
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver