On Fri, Dec 09, 2005 at 05:13:53PM +0200, Etienne Pretorius wrote:
> Ok, I have spent the day recompiling the kernel to vsersion 2.6.12 with
> util-vserver 0.30.209-0.
>
> Now trying to get hide_netif to be disabled...
> So you are suppose to exclude this value right inside
> /etc/vservers/<vsname>/flags....
> " [root@debian /etc/vservers/standard]# cat flags
> [root@debian /etc/vservers/standard]#
> "
>
> " [root@debian /etc/vservers/standard]# vserver standard enter
> [root@standard:/] route -n
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref
> Use Iface
> 255.255.255.255 0.0.0.0 255.255.255.255 UH 0
> 0 0 br0
> 165.146.128.1 0.0.0.0 255.255.255.255 UH 0
> 0 0 *
> 192.168.5.0 0.0.0.0 255.255.255.0 U 0
> 0 0 br0
> 192.168.1.0 0.0.0.0 255.255.255.0 U 0
> 0 0 eth1
> 0.0.0.0 0.0.0.0 0.0.0.0 UG 0
> 0 0 *
>
> [root@standard:/] logout
> [root@debian /etc/vservers/standard]# route -n
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref
> Use Iface
> 255.255.255.255 0.0.0.0 255.255.255.255 UH 0
> 0 0 br0
> 165.146.128.1 0.0.0.0 255.255.255.255 UH 0
> 0 0 ppp0
> 192.168.5.0 0.0.0.0 255.255.255.0 U 0
> 0 0 br0
> 192.168.1.0 0.0.0.0 255.255.255.0 U 0
> 0 0 eth1
> 0.0.0.0 165.146.128.1 0.0.0.0 UG 0
> 0 0 ppp0
> [root@debian /etc/vservers/standard]#
>
> Chain PREROUTING (policy ACCEPT 168 packets, 12829 bytes)
> pkts bytes target prot opt in out source
> destination
> 0 0 DNAT tcp -- * * 192.168.5.0/24
> !192.168.5.0/24 tcp dpt:80 PHYSDEV match --physdev-in eth0
> to:192.168.5.1:8080
> 0 0 DNAT tcp -- * * 192.168.5.0/24
> 0.0.0.0/0 tcp dpt:21 PHYSDEV match --physdev-in eth0
> to:192.168.5.1:2121
> 0 0 REDIRECT tcp -- * * 192.168.5.0/24
> !192.168.5.0/24 tcp dpt:25 PHYSDEV match --physdev-in eth0
>
> Chain POSTROUTING (policy ACCEPT 129 packets, 8683 bytes)
> pkts bytes target prot opt in out source
> destination
> 2 146 SNAT all -- * ppp+ 0.0.0.0/0
> 0.0.0.0/0 to:165.146.183.189
>
> Chain OUTPUT (policy ACCEPT 236 packets, 16028 bytes)
> pkts bytes target prot opt in out source
> destination
> "
> Can't get it working, and I can't route packets out of the guest
> system to the internet. If you look at the routes.... the vserver does
> not know where to send it. I Can ping the the other side of the ppp
> link ie "165.146.128.1" from with the vserver but I just can't get
> further then that.
>
> Can anyone advise me on how to get the guest system to access the
> internet ---- please!
remove all your strange settings/configs/whatever and
do the following (simple approach)
- configure a private IP for your guest (e.g. 10.0.0.2)
--interface hansi=eth0:10.0.0.2/24
- add the required SNAT rule (make sure that no other
rule will block/drop/whatever)
iptables -t nat -I POSTROUTING -s 10.0.0.2 -j SNAT --to 165.146.183.189
165.146.183.189 is assumed to be the 'local' IP the ppp
interface was assigned (not the remote IP or gateway)
- start the guest and verify your setup (on the host) with
ping -c 2 -I 165.146.183.189 www.google.com (works by default)
ping -c 2 -I 10.0.0.2 www.google.com
(works when the SNAT is configured correctly)
best,
Herbert
> Thank you all, who have read this.
>
> Etienne
>
> _______________________________________________
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Sat Dec 10 03:54:16 2005