Re: [vserver] Networking setup question

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Wed 18 Mar 2009 - 11:12:56 GMT
Message-ID: <20090318111256.GG19650@MAIL.13thfloor.at>

On Tue, Mar 17, 2009 at 11:28:40AM -0400, Edward Capriolo wrote:
> Have you taken a look at?
> http://linux-vserver.org/Networking_vserver_guests_RHEL

> Recently I have found that creating the dummy network on the vserver
> host is not needed for the guest to have outbound connectivity. You
> only need one thing, an outbound postrouting rule in iptables.

congrats!

> -A POSTROUTING -s 10.0.0.0/255.255.255.0 -d ! 10.0.2.0/255.255.255.0
> -j MASQUERADE

> Also guests need a working /etc/resolv.conf.

> As far as I can tell the dummy interface may only be needed if there
> are multiple physical machines on the same network that will have
> guests on the 10.0.0.0/24 network. VServer does the job of managing
> the routing table for the local addresses used by the vserver.

the dummy interface is never needed, unless you
actually want to discard packets during routing, or
test a software which only broadcasts stuff you are
not interested in ...

but it seems that folks are happier to bind the
guest IPs to dummy0 than to eth0 or lo, fact is, that
for outgoing traffic one of the ethX devices will be
used and for local traffic (Host-Guest, Guest-Guest)
lo, otherwise it would not work :)

best,
Herbert

> On Mon, Mar 16, 2009 at 8:14 PM, Matt Paine <matt@mattsoftware.com> wrote:
> > Hi Again...
> >
> >
> >> what i personally do is to create a "virtual" network card and let the
> >> VServer guests listen on that interface.
> >> you can just add an extra interface like this
> >> (in debian you add it in /etc/network/interfaces)
> >> auto dummy0
> >> iface dummy0 inet static
> >>   address 192.168.1.1
> >>   netmask 255.255.255.0
> >>
> >> in order to be reachable i use shorewall to route the trafic i want from
> >> external IP on eth0 to the VServer guest IP on dummy0.
> >
> >
> > I'm using CentOS - so I added the dummy interface details to
> > /etc/sysconfig/network-scripts/ifcfg-dummy0 and off I went - no dramas.
> >
> > I am still not getting traffic routed from my guest, in your example you use
> > Shorewall - having never setup this solution I am cautiously hesitant to set
> > this up on my production box (although I have seen RPM's available for it, I
> > am still hesitant until I have had experience with it - I would hate my
> > remote production box to become unreachable for a config issue).
> >
> > Does anyone have a set of route/iptables rules I might be able to add to get
> > the guest to achieve access to the outside world?
> >
> > Thankyou again for any hints :)
> >
> > ......
> > (output from route below if that helps)
> > ......
> >
> >
> > Matt
> > mattsoftware.com
> >
> >
> >
> >
> >
> > (route from host)
> > [root@vps local]# route -n
> > Kernel IP routing table
> > Destination     Gateway         Genmask         Flags Metric Ref    Use
> > Iface
> > 10.0.1.1        0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
> > 121.50.218.160  0.0.0.0         255.255.255.248 U     0      0        0 eth0
> > 10.0.0.0        0.0.0.0         255.255.0.0     U     0      0        0
> > dummy0
> > 169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0
> > dummy0
> > 0.0.0.0         121.50.218.161  0.0.0.0         UG    0      0        0 eth0
> >
> >
> >
> > (route from guest)
> > bash-3.2# route -n
> > Kernel IP routing table
> > Destination     Gateway         Genmask         Flags Metric Ref    Use
> > Iface
> > 10.0.1.1        0.0.0.0         255.255.255.255 UH    0      0        0 *
> > 121.50.218.160  0.0.0.0         255.255.255.248 U     0      0        0 *
> > 10.0.0.0        0.0.0.0         255.255.0.0     U     0      0        0
> > dummy0
> > 169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0
> > dummy0
> > 0.0.0.0         0.0.0.0         0.0.0.0         UG    0      0        0 *
> >
> >
> >
> >
Received on Wed Mar 18 11:13:08 2009

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 18 Mar 2009 - 11:13:09 GMT by hypermail 2.1.8