Re: [Vserver] What's going on!

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Sat 10 Dec 2005 - 03:53:57 GMT
Message-ID: <20051210035357.GA20294@MAIL.13thfloor.at>

On Fri, Dec 09, 2005 at 05:13:53PM +0200, Etienne Pretorius wrote:
> Ok, I have spent the day recompiling the kernel to vsersion 2.6.12 with
> util-vserver 0.30.209-0.
>
> Now trying to get hide_netif to be disabled...
> So you are suppose to exclude this value right inside
> /etc/vservers/<vsname>/flags....
> " [root@debian /etc/vservers/standard]# cat flags
> [root@debian /etc/vservers/standard]#
> "
>
> " [root@debian /etc/vservers/standard]# vserver standard enter
> [root@standard:/] route -n
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref
> Use Iface
> 255.255.255.255 0.0.0.0 255.255.255.255 UH 0
> 0 0 br0
> 165.146.128.1 0.0.0.0 255.255.255.255 UH 0
> 0 0 *
> 192.168.5.0 0.0.0.0 255.255.255.0 U 0
> 0 0 br0
> 192.168.1.0 0.0.0.0 255.255.255.0 U 0
> 0 0 eth1
> 0.0.0.0 0.0.0.0 0.0.0.0 UG 0
> 0 0 *
>
> [root@standard:/] logout
> [root@debian /etc/vservers/standard]# route -n
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref
> Use Iface
> 255.255.255.255 0.0.0.0 255.255.255.255 UH 0
> 0 0 br0
> 165.146.128.1 0.0.0.0 255.255.255.255 UH 0
> 0 0 ppp0
> 192.168.5.0 0.0.0.0 255.255.255.0 U 0
> 0 0 br0
> 192.168.1.0 0.0.0.0 255.255.255.0 U 0
> 0 0 eth1
> 0.0.0.0 165.146.128.1 0.0.0.0 UG 0
> 0 0 ppp0
> [root@debian /etc/vservers/standard]#
>
> Chain PREROUTING (policy ACCEPT 168 packets, 12829 bytes)
> pkts bytes target prot opt in out source
> destination
> 0 0 DNAT tcp -- * * 192.168.5.0/24
> !192.168.5.0/24 tcp dpt:80 PHYSDEV match --physdev-in eth0
> to:192.168.5.1:8080
> 0 0 DNAT tcp -- * * 192.168.5.0/24
> 0.0.0.0/0 tcp dpt:21 PHYSDEV match --physdev-in eth0
> to:192.168.5.1:2121
> 0 0 REDIRECT tcp -- * * 192.168.5.0/24
> !192.168.5.0/24 tcp dpt:25 PHYSDEV match --physdev-in eth0
>
> Chain POSTROUTING (policy ACCEPT 129 packets, 8683 bytes)
> pkts bytes target prot opt in out source
> destination
> 2 146 SNAT all -- * ppp+ 0.0.0.0/0
> 0.0.0.0/0 to:165.146.183.189
>
> Chain OUTPUT (policy ACCEPT 236 packets, 16028 bytes)
> pkts bytes target prot opt in out source
> destination
> "
> Can't get it working, and I can't route packets out of the guest
> system to the internet. If you look at the routes.... the vserver does
> not know where to send it. I Can ping the the other side of the ppp
> link ie "165.146.128.1" from with the vserver but I just can't get
> further then that.
>
> Can anyone advise me on how to get the guest system to access the
> internet ---- please!

remove all your strange settings/configs/whatever and
do the following (simple approach)

 - configure a private IP for your guest (e.g. 10.0.0.2)
   --interface hansi=eth0:10.0.0.2/24
 - add the required SNAT rule (make sure that no other
   rule will block/drop/whatever)
   iptables -t nat -I POSTROUTING -s 10.0.0.2 -j SNAT --to 165.146.183.189

165.146.183.189 is assumed to be the 'local' IP the ppp
interface was assigned (not the remote IP or gateway)

 - start the guest and verify your setup (on the host) with
   ping -c 2 -I 165.146.183.189 www.google.com (works by default)
   ping -c 2 -I 10.0.0.2 www.google.com
        (works when the SNAT is configured correctly)

best,
Herbert

> Thank you all, who have read this.
>
> Etienne
>
> _______________________________________________
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Sat Dec 10 03:54:16 2005

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sat 10 Dec 2005 - 03:54:20 GMT by hypermail 2.1.8