[vserver] How to make VServer-Guest to use other NIC than the VServer-Host

From: Marcus Mülbüsch <m.muelbuesch_at_googlemail.com>
Date: Thu 02 Sep 2010 - 13:55:35 BST
Message-ID: <4C7F9EC7.2090101@googlemail.com>

Hello all,

    I have a server with two NICs. I'd like to have the host use one of
the NICs (with a 192.168.1.x-address), while the Guest uses the other
NIC only (with a 192.168.2.x).

    This sort of puts the guest into the DMZ, while I can reach the host
in the internal net, and then enter the guest.

    While that it is not as good as putting the whole machine into the
DMZ it saves on hardware and keeps the infrastructure small.

    First, is there anything basically wrong with that reasoning? It may
be easier to break out from a VServer guest into the host as breaking
through another firewall, but not by much.

    Second, and here is where my problem starts:

- The second NIC (eth1) is not assigned an IP address on the host.

- The VServer is assigned eth1 as its one and only NIC.
/etc/vservers/myserver/interfaces/0/dev ./ip and ./prefix are set to
"eth1", "192.168.3.x", and "24" respectively.

- Now, when the VServer is started, something "interesting" happens -
Even though eth0 is not activated, it shows up with "ip route show",
though as "if1"

192.168.3.0/24 dev eth1 proto kernel scope link src 192.168.3.x
192.168.1.0/24 dev if1 proto kernel scope link src 192.168.1.x
127.0.0.0/8 dev if3 scope link
default via 192.168.1.x dev if1

    Especially annoying is the fact that the default gateway is the one
of the Vserver Host. No wonder it doesn't work.

    I could change the routing on the host, using "ip route del" and "ip
route add". However that would mean to give the guest "NET_ADMIN"
capability; which means it is a very bad idea.

    I feel I'm missing something very basic about either VServers or
Advanced Routing :)

    What am I doing wrong?

I'm using Versions:
     Kernel: 2.6.22-vs2.2.0.7-gentoo
     VS-API: 0x00020200
     util-vserver: 0.30.215; Jan 13 2010, 12:12:31

Thanks for any help or pointers,

Marcus
Received on Thu Sep 2 13:56:19 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 02 Sep 2010 - 13:56:19 BST by hypermail 2.1.8