On Thu, Sep 02, 2010 at 02:55:35PM +0200, Marcus Mülbüsch wrote:
> Hello all,
> I have a server with two NICs. I'd like to have the host use one of
> the NICs (with a 192.168.1.x-address), while the Guest uses the other
> NIC only (with a 192.168.2.x).
> This sort of puts the guest into the DMZ, while I can reach the host
> in the internal net, and then enter the guest.
> While that it is not as good as putting the whole machine into the
> DMZ it saves on hardware and keeps the infrastructure small.
> First, is there anything basically wrong with that reasoning? It may
> be easier to break out from a VServer guest into the host as breaking
> through another firewall, but not by much.
> Second, and here is where my problem starts:
> - The second NIC (eth1) is not assigned an IP address on the host.
so you are using network namespaces then?
because Linux-VServer by default uses network isolation,
in which case the host always has _all_ the IPs assigned
(those host only as well as all guest IPs)
> - The VServer is assigned eth1 as its one and only NIC.
> /etc/vservers/myserver/interfaces/0/dev ./ip and ./prefix are set to
> "eth1", "192.168.3.x", and "24" respectively.
that doesn't mean that you 'assign' eth1 to anything,
on the contrary, it only means that the IP (192.168.3.x)
will be _assigned_ to eth1, when the guest is started
(and removed from eth1 on guest shutdown)
> - Now, when the VServer is started, something "interesting" happens -
> Even though eth0 is not activated, it shows up with "ip route show",
> though as "if1"
that is fine, as a route exists to the interface which
is relevant for that guest
> 192.168.3.0/24 dev eth1 proto kernel scope link src 192.168.3.x
> 192.168.1.0/24 dev if1 proto kernel scope link src 192.168.1.x
> 127.0.0.0/8 dev if3 scope link
> default via 192.168.1.x dev if1
> Especially annoying is the fact that the default gateway is the one
> of the Vserver Host. No wonder it doesn't work.
again, for network isolation that is expected, you'll
need to setup multiple routing tables to have a different
default gateway for the guest IPs ...
> I could change the routing on the host, using "ip route del" and "ip
> route add". However that would mean to give the guest "NET_ADMIN"
> capability; which means it is a very bad idea.
in what way would that help and why does the guest need
NET_ADMIN if you change something on the host?
> I feel I'm missing something very basic about either VServers or
> Advanced Routing :)
probably, my guess would be network isolation vs network
context (and thus virtual network stack as used in qemu or
similar)
> What am I doing wrong?
> I'm using Versions:
> Kernel: 2.6.22-vs2.2.0.7-gentoo
> VS-API: 0x00020200
> util-vserver: 0.30.215; Jan 13 2010, 12:12:31
quite old kernel, ancient tools, so all you have here is
IP isolation (network contexts require quite recent kernels,
patches and util-vserver to get them working)
HTH,
Herbert
> Thanks for any help or pointers,
> Marcus
Received on Sat Sep 4 05:03:37 2010