About this list Date view Thread view Subject view Author view Attachment view

From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Wed 22 Dec 2004 - 13:13:35 GMT


On Wed, Dec 22, 2004 at 10:44:05AM +0100, Lars E. D. Jensen wrote:
> Hi list
>
> I've tried different configurations, and it seems that I cannot make a fake
> DMZ of vservers within 1 root server?
>
> Reason to do it is that I would like to avoid using all my assigned IP
> addresses on vservers who just run 1 service each.
>
> eth0 is the internet interface which is assigned only 1 public IP
>
> eth1 is the interface of the fake DMZ and has assigned IPs like
> 192.168.250.xxx to vservers running different services.
>
> I use iptables to forward requests to eth0 (public IP) to services on eth1
> (192.168...), but I have no success doing that :(
>
> Is my idea impossible?

yes, and it doesn't really matter what interface you
choose, as long as it is available on the host

(eth0, eth1 or dummy)

ifconfig lo 127.0.0.1
ifconfig eth0 10.0.0.2
ifconfig eth0:a 192.168.0.2
ifconfig eth0:b 192.168.0.3
ifconfig eth0:c 192.168.0.4

# chbind --ip 192.168.0.2 ping -c 1 -I 192.168.0.2 10.0.0.1
ipv4root is now 192.168.0.2
PING 10.0.0.1 (10.0.0.1) from 192.168.0.2 : 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=9.985 msec

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/mdev = 9.985/9.985/9.985/0.000 ms

14:09:26.502039 52:54:0:12:34:56 ff:ff:ff:ff:ff:ff 0806 60: arp who-has 10.0.0.1 tell 192.168.0.2
14:09:26.502142 0:ff:d3:cb:62:e3 52:54:0:12:34:56 0806 42: arp reply 10.0.0.1 is-at 0:ff:d3:cb:62:e3
14:09:26.503788 52:54:0:12:34:56 0:ff:d3:cb:62:e3 0800 98: 192.168.0.2 > 10.0.0.1: icmp: echo request (DF) (ttl 64, id 0, len 84)
14:09:26.503903 0:ff:d3:cb:62:e3 ff:ff:ff:ff:ff:ff 0806 42: arp who-has 10.0.0.2 tell 10.0.0.1
14:09:26.505350 52:54:0:12:34:56 0:ff:d3:cb:62:e3 0806 60: arp reply 10.0.0.2 is-at 52:54:0:12:34:56
14:09:26.505380 0:ff:d3:cb:62:e3 52:54:0:12:34:56 0800 98: 10.0.0.1 > 192.168.0.2: icmp: echo reply (ttl 64, id 51498, len 84)

# iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to-source 10.0.0.2

# chbind --ip 192.168.0.2 ping -c 1 -I 192.168.0.2 10.0.0.1
ipv4root is now 192.168.0.2
PING 10.0.0.1 (10.0.0.1) from 192.168.0.2 : 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=3.345 msec

--- 10.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/mdev = 3.345/3.345/3.345/0.000 ms

14:10:42.704591 52:54:0:12:34:56 0:ff:d3:cb:62:e3 0800 98: 10.0.0.2 > 10.0.0.1: icmp: echo request (DF) (ttl 64, id 0, len 84)
14:10:42.704741 0:ff:d3:cb:62:e3 52:54:0:12:34:56 0800 98: 10.0.0.1 > 10.0.0.2: icmp: echo reply (ttl 64, id 9309, len 84)

of course you need similar rules for incoming packets
if you want to distribute those services ...

HTH,
Herbert

> If anyone have some example configuration I would really like to see it.
>
> Thanks.
>
> --
> Med venlig hilsen / Best regards
>
> Lars E. D. Jensen
> lars_at_dangvard.dk
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 22 Dec 2004 - 13:13:48 GMT by hypermail 2.1.3