Re: [vserver] Networking setup question

From: Edward Capriolo <edlinuxguru_at_gmail.com>
Date: Tue 17 Mar 2009 - 15:28:40 GMT
Message-ID: <cbbf4b570903170828j1db6b5f9ua2598556a6ccf2d9@mail.gmail.com>

Have you taken a look at?
http://linux-vserver.org/Networking_vserver_guests_RHEL

Recently I have found that creating the dummy network on the vserver
host is not needed for the guest to have outbound connectivity. You
only need one thing, an outbound postrouting rule in iptables.

-A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.2.0/255.255.255.0
-j MASQUERADE

Also guests need a working /etc/resolv.conf.

As far as I can tell the dummy interface may only be needed if there
are multiple physical machines on the same network that will have
guests on the 10.0.0.0/24 network. VServer does the job of managing
the routing table for the local addresses used by the vserver.

On Mon, Mar 16, 2009 at 8:14 PM, Matt Paine <matt@mattsoftware.com> wrote:
> Hi Again...
>
>
>> what i personally do is to create a "virtual" network card and let the
>> VServer guests listen on that interface.
>> you can just add an extra interface like this
>> (in debian you add it in /etc/network/interfaces)
>> auto dummy0
>> iface dummy0 inet static
>>   address 192.168.1.1
>>   netmask 255.255.255.0
>>
>> in order to be reachable i use shorewall to route the trafic i want from
>> external IP on eth0 to the VServer guest IP on dummy0.
>
>
> I'm using CentOS - so I added the dummy interface details to
> /etc/sysconfig/network-scripts/ifcfg-dummy0 and off I went - no dramas.
>
> I am still not getting traffic routed from my guest, in your example you use
> Shorewall - having never setup this solution I am cautiously hesitant to set
> this up on my production box (although I have seen RPM's available for it, I
> am still hesitant until I have had experience with it - I would hate my
> remote production box to become unreachable for a config issue).
>
> Does anyone have a set of route/iptables rules I might be able to add to get
> the guest to achieve access to the outside world?
>
> Thankyou again for any hints :)
>
> ......
> (output from route below if that helps)
> ......
>
>
> Matt
> mattsoftware.com
>
>
>
>
>
> (route from host)
> [root@vps local]# route -n
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use
> Iface
> 10.0.1.1        0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
> 121.50.218.160  0.0.0.0         255.255.255.248 U     0      0        0 eth0
> 10.0.0.0        0.0.0.0         255.255.0.0     U     0      0        0
> dummy0
> 169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0
> dummy0
> 0.0.0.0         121.50.218.161  0.0.0.0         UG    0      0        0 eth0
>
>
>
> (route from guest)
> bash-3.2# route -n
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Metric Ref    Use
> Iface
> 10.0.1.1        0.0.0.0         255.255.255.255 UH    0      0        0 *
> 121.50.218.160  0.0.0.0         255.255.255.248 U     0      0        0 *
> 10.0.0.0        0.0.0.0         255.255.0.0     U     0      0        0
> dummy0
> 169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0
> dummy0
> 0.0.0.0         0.0.0.0         0.0.0.0         UG    0      0        0 *
>
>
>
>
Received on Tue Mar 17 15:28:59 2009

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Tue 17 Mar 2009 - 15:29:00 GMT by hypermail 2.1.8