Re: [vserver] VServer with Host as Gateway

From: Daniel Hokka Zakrisson <daniel_at_hozac.com>
Date: Wed 24 Oct 2007 - 21:24:11 BST
Message-ID: <471FA9EB.2010202@hozac.com>

Stuart Lester wrote:
> Well, I've figured out _a_ solution, though it may not be _the_ solution:
> The virtual guest has two NICs, eth0 and eth1. Traffic for the WAN
> goes out on eth0, Traffic for the LAN goes out on eth1. Just like
> with the virtual host. I had hoped to not do this, as it doesn't feel
> as "clean" as a single NIC for the virtual guest, but in some ways it
> is infinitely simpler than all the various routing schemes I've tried.

You shouldn't even need that (see below).

> Daniel...can you explain your statement below about getting stuck in a
> loop? Traffic for me seems to be fine.

> routes_eth1=( "10.50.50.0/24 src 10.50.50.10 table 192net2")
> routes_eth1=( "10.50.50.0/24 src 10.50.50.1 table 192net2")
> routes_eth1=( "default via 10.50.50.1 table 192net2" )
> rules_eth1=( "from 10.50.50.0/24 table 192net2" )

You are basically saying "traffic from 10.50.50.0/24 should go to
10.50.50.1", which is that box, rinse and repeat...

> My current configs are as follows (I can send the iptables commands if
> that is easier to read...none of it is particularly easy for me to
> decipher):
> HOST ~ # iptables -L

Always use iptables -nvL, it shows more information and disables those
darned lookups.

> Chain INPUT (policy ACCEPT)
> target prot opt source destination
>
> Chain FORWARD (policy DROP)
> target prot opt source destination
> ACCEPT all -- 10.50.50.0/24 anywhere
> ACCEPT all -- anywhere 10.50.50.0/24
>
> Chain OUTPUT (policy ACCEPT)
> target prot opt source destination
>
> HOST ~ # iptables -t nat -L
> Chain PREROUTING (policy ACCEPT)
> target prot opt source destination
> DNAT tcp -- anywhere anywhere tcp
> dpt:ssh to:10.50.50.1:22
>
> Chain POSTROUTING (policy ACCEPT)
> target prot opt source destination
> SNAT all -- anywhere anywhere
> to:192.168.100.254

With this rule, the guest will never use its second IP address anyway.

> Chain OUTPUT (policy ACCEPT)
> target prot opt source destination
>
> And for completeness, my /etc/conf.d/net looks like:
> config_eth0=(
> "192.168.100.253/24"
> "192.168.100.254/24")
> routes_eth0=( "default via 192.168.100.1" )
>
> config_eth1=(
> "10.50.50.1/24"
> "10.50.50.10/24"
> )
>
> Is there anything that you guys see in this that makes it a bad idea?
> The biggest flaw I see right now is that if/when I remove that linksys
> router from between this machine an the cable modem, I won't have the
> luxury of multiple IPs on eth0.
>
> Stu

-- 
Daniel Hokka Zakrisson
Received on Wed Oct 24 21:25:01 2007
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 24 Oct 2007 - 21:25:07 BST by hypermail 2.1.8