Re: [vserver] VServer with Host as Gateway

From: Stuart Lester <stuart.lester_at_gmail.com>
Date: Wed 24 Oct 2007 - 22:24:48 BST
Message-ID: <2cda49570710241424o34c7b4d4te5248cbccfa15cab@mail.gmail.com>

On 10/24/07, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
> Stuart Lester wrote:
> > Daniel...can you explain your statement below about getting stuck in a
> > loop? Traffic for me seems to be fine.
>
> > routes_eth1=( "10.50.50.0/24 src 10.50.50.10 table 192net2")
> > routes_eth1=( "10.50.50.0/24 src 10.50.50.1 table 192net2")
> > routes_eth1=( "default via 10.50.50.1 table 192net2" )
> > rules_eth1=( "from 10.50.50.0/24 table 192net2" )
>
> You are basically saying "traffic from 10.50.50.0/24 should go to
> 10.50.50.1", which is that box, rinse and repeat...

Gotcha. FWIW, I believe that no loop was being created because gentoo's net
configs only allow one instance each of routes_ethX, so the subsequent lines
weren't being processed. Additionally, I don't have any evidence that the
rules_ethX were _ever_ being processed...any gentoo experts out there care
to confirm this?

> > My current configs are as follows (I can send the iptables commands if
> > that is easier to read...none of it is particularly easy for me to
> > decipher):
> > HOST ~ # iptables -L
>
> Always use iptables -nvL, it shows more information and disables those
> darned lookups.

Great tip, thanks!

> > Chain POSTROUTING (policy ACCEPT)
> > target prot opt source destination
> > SNAT all -- anywhere anywhere
> > to:192.168.100.254
>
> With this rule, the guest will never use its second IP address anyway.

Hot dog, you're right! That solves my multiple IP issues...thanks.

BTW, someone also mentioned off-list that shorewall should do this as
well...I'm sure that it will (he even had a working config), but I decided
to try this method so as to not add another software package on top of this
that I'd have to figure out (at least at a superficial level).

Thanks to everyone for your suggestions and help,
Stu
Received on Wed Oct 24 22:24:57 2007

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 24 Oct 2007 - 22:25:03 BST by hypermail 2.1.8