John A. Sullivan III wrote:
> On Fri, 2009-07-17 at 18:26 -0400, John A. Sullivan III wrote:
>
>> Hello, all. May I ask what the purpose and syntax of
>> the /etc/vservers/<vserver name>/interfaces/<iface>/tun file is? I'm
>> exploring using OpenVPN as a client within a vserver. The instructions
>> on the FAQ are starting to make sense although I do not know if they are
>> current. But I'd like to understand what is happening when I take those
>> steps and why there seem to be many parameters pertaining to tun/tap
>> interaces listed on the Great Flower Page which are not referenced in
>> the FAQ. Thanks - John
>>
> Actually, as I think about running a client rather than a server the
> client's needs to add routes, etc., I almost wonder if I really need to
> run all the clients with all their different configs in the host and
> then use the source routing capabilities of iproute2 to send the
> appropriate vserver's traffic through the correct tunnel. Sounds a bit
> dangerous but doable - John
>
In general the vserver philisophy seems to be to disallow system type
operations (such as mangling routes, etc) in the client and restrict
these to the host. Various IPC mechanisms allow you to do restricted
communication back to the host to get it to do what you want.
Of course it's also entirely possible to grant the client access to the
actual network stack and let it do what it wishes, but since this is not
a virtualised type of system you also give the client the possibility to
break things for everybody, and hence it's not recommended
I guess it depends on your exact needs and how much you trust stuff
running in the clients?
If it's all done once at setup time for each client then I would have
thought doing it in the host was the simplest option?
Good luck
Ed W
Received on Sat Jul 18 17:21:24 2009