On Sun, Jul 19, 2009 at 12:45:57AM -0400, John A. Sullivan III wrote:
> How can one tell iproute2 to distinguish packets from different
> vservers before it makes a routing decision? We would like to
> establish different routing tables for different vservers but need
> to do this before the source address is determined in vservers with
> multiple interfaces. It looks like my decision criteria for iproute2
> routing rules are:
> iif (incoming interface)
> tos and dsfield
> To illustrate, let's suppose I have a vserver host with eth0 and tun0.
> There are several vservers using eth0. Now imagine a vserver which uses
> both interfaces, say eth0=10.1.1.10 and tun0=10.2.2.10 with a default
> gateway of 10.1.1.1. Now I want packets destined for 10.3.3.0/24 to use
> the 10.2.2.10 source address and the tun0 interface. I do not want any
> of the other vservers to see the route to 10.3.3.0/24.
that's what multiple routing tables are for
> I can do:
> ip route add 10.3.3.0/24 via 10.2.2.1 src 10.2.2.10 table special
> but the challenge is defining a rule which will apply only to this
> special vserver to read the special table.
> ip rule add to 10.3.3.0/24 table special prio 1000
> would be read by all vservers and I might as well put the route in the
> main table.
> ip rule add iif lo or eth0 would be the same.
> ip rule from 10.1.1.10 table special pri 1000
> would work but is too late to change the source address since the source
> has obviously already been chosen. At least this appears to be the
> behavior we observed when we tried this.
you could always SNAT it afterwards ...
> I could make 10.2.2.10 the primary address but then I have the reverse
> problem for where I want to use 10.1.1.10 or when I introduce a third
> I thought of using fwmark but all that does is transfer the problem of
> identifying the traffic from a specific vserver to iptables.
> So how does one identify traffic from a specific vserver in either
> iptables or iproute2 other than by the source IP address? Thanks - John
I don't see the problem, do have more than one guest
using the same IP? if so, you need a different criterion,
otherwise the source IP (whatever it may be) is more
than sufficient to identify packets from a specific guest
which you can easily use for branching to a separate
> John A. Sullivan III
> Open Source Development Corporation
> +1 207-985-7880
> Making Christianity intelligible to secular society
Received on Sun Jul 19 11:35:53 2009