Re: [vserver] Avoiding kernel internal routing among vserver clients

From: Thomas Weber <l_vserver_at_mail2news.4t2.com>
Date: Wed 08 Aug 2007 - 15:47:21 BST
Message-Id: <1186584441.25125.67.camel@localhost>

Am Mittwoch, den 08.08.2007, 10:30 +0200 schrieb Baltasar Cevc:
> Thomas,
>
> On Wed, 08 Aug 2007 03:25:29 +0200
> Thomas Weber <l_vserver@mail2news.4t2.com> wrote:
>
> > Am Mittwoch, den 08.08.2007, 01:48 +0200 schrieb Herbert Poetzl:

> You could just leave out the interface and everything would be more or
> less the same for filtering (INPUT for both ethX and lo). For NAT and

[... i'm aware how to set up firewalling rules on the host ...]

> iptables -A INPUT -i lo -d <vserver-net> -j VSERVERS
> [rules inserted by script into VSERVERS follow]
>
> We have some more checks, but in principle, it looks like that.
>
> With this design, you can just filter for subnets in the VSERVERS
> chain and ignore the incoming interface.

I dont want this approach for the same reason that companies setup
central firewalls instead of managing firewalling on every single host.
(Of course it's always a good idea to secure the hosts themself, but not
doing so shouldn't rip holes into the setup of the whole network).

> > > you just make the firewall rules for ethX _and_ lo
> > > and you are perfectly fine, wherever the guest is
> >
> > 3 hosts, 2 production, one for development/testing, later maybe more.
> > I'd have to manage firewalling rules on the GW and on 3 hosts. The one
> > responsible for the GW is not the one responsible for the vserver
> > hosts. Managing 3 different systems (GW, production,development) with
> > their own firewalling semantics for the same rules on 4+ boxes is
> > asking for trouble.
> > Don't you think that'd be bad design?
> Depends on how you implement it, I'd say.

Yeah, thats like dropping DNS and using /etc/hosts instead. I'm sure it
works if you implement it right.

> > > > IDS would be another issue.
> > >
> > > assuming that IDS stands for Intrusion-Detection System
> > > what problem do you see with that?
> >
> > IDS setup on the GW won't see all vserver-vserver traffic.
> > Same with accounting etc.
> > In case of an incident when one of the production machines goes down
> > and the other hosts all vservers, accounting would show less traffic
> > and the IDS wouldn't see anything at all.
> I see your point with accounting; just one thing to say anyway: traffic
> on lo is _really_ inexpensive anytime, so I probably wouldn't mind
> trying to account that.

This is not about cost. This is about trends in traffic, about spikes,
about accounting different protocols and future planing of the network
infrastructure.

> But about the traffic hitting the wire: IP is routed stuff. Wouldn't
> the packets have to have the ARP destination of the localhost, thus not
> even hitting the wire when they were sent to the ethernet card?

As I said in my initial post, the vservers i'm talking about are on
different subnets and different NICs (same host though).

  Tom
Received on Wed Aug 8 15:47:46 2007

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 08 Aug 2007 - 15:47:50 BST by hypermail 2.1.8