On 22/06/2010 7:27 PM, Herbert Poetzl wrote:
> On Mon, Jun 21, 2010 at 10:35:36PM -0700, Siv wrote:
>> My requirement is to allow different routing table for the
>> guest and host.
>> Is that possible?
> yes, if you want performance, use multiple routing tables
> and select them based on the source IP, if you don't care
> about performance, check out the network namespaces, they
> will allow you to have 'virtual' network spaces
>
>> Please let me know,
> best,
> Herbert
Hi Herbert,
On a related note - I was wondering if you could let me know if what I
am seeing is normal or I have broken my vserver config somehow..
Kernel: 2.6.31.13-vs2.3.0.36.28.2-beng
VS-API: 0x00020305
util-vserver: 0.30.216-pre2883; Apr 28 2010, 15:36:17
I currently utilize source routing using the iproute2 system, however I
was wondering if its normal for the guests to be able able to see all
the rules and routes even if they do not apply to them.
'ip addr ls' only shows the assigned interfaces, however 'ip route ls'
shows extra routes which give away the source IP.
eg:
[gizmo1:~]# ip addr ls
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
state UP qlen 1000
link/ether 00:0d:60:9c:37:82 brd ff:ff:ff:ff:ff:ff
inet 10.1.1.20/24 brd 10.1.1.255 scope global secondary eth0
inet xxx.xxx.194.119/27 brd xxx.xxx.194.127 scope global secondary eth0
[gizmo1:~]# ip route ls
xxx.xxx.194.96/27 dev eth0 proto kernel scope link src xxx.xxx.194.113
xxx.xxx.201.128/25 dev eth0 proto kernel scope link src xxx.xxx.201.162
xxx.xxx.219.0/24 dev eth0 proto kernel scope link src xxx.xxx.219.34
xxx.xxx.194.0/24 dev eth0 proto kernel scope link src xxx.xxx.194.118
10.1.1.0/24 dev eth0 proto kernel scope link src 10.1.1.36
default via xxx.xxx.194.97 dev eth0 src xxx.xxx.194.113
[gizmo1:~]# ip rule ls
0: from all lookup local
9999: from 10.1.1.0/24 to xxx.xxx.194.0/24 lookup 203
20000: from xxx.xxx.194.118 lookup 204
20000: from xxx.xxx.194.119 lookup 205
20000: from xxx.xxx.194.125 lookup 210
20000: from xxx.xxx.201.162 lookup 210
20000: from xxx.xxx.219.34 lookup 210
20000: from xxx.xxx.219.202 lookup 210
32766: from all lookup main
32767: from all lookup default
[root@gizmo1:~]#
It's not a huge issue for us at the moment as most of the our vserver
guests are internal servers - however we were looking at offering it as
a service, which means now I have to worry more about security.
I will look into the network namespaces as that may be the safest option
for those specific servers, but I just wanted to make sure I haven't
done something wrong along the way which is allowing this information to
be shown.
Regards,
Mark
Received on Wed Jun 23 02:28:16 2010