Re: [vserver] How to make VServer-Guest to use other NIC than the VServer-Host

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Sat 04 Sep 2010 - 05:02:59 BST
Message-ID: <20100904040259.GB13882@MAIL.13thfloor.at>

On Thu, Sep 02, 2010 at 02:55:35PM +0200, Marcus Mülbüsch wrote:
> Hello all,

> I have a server with two NICs. I'd like to have the host use one of
> the NICs (with a 192.168.1.x-address), while the Guest uses the other
> NIC only (with a 192.168.2.x).

> This sort of puts the guest into the DMZ, while I can reach the host
> in the internal net, and then enter the guest.

> While that it is not as good as putting the whole machine into the
> DMZ it saves on hardware and keeps the infrastructure small.

> First, is there anything basically wrong with that reasoning? It may
> be easier to break out from a VServer guest into the host as breaking
> through another firewall, but not by much.

> Second, and here is where my problem starts:

> - The second NIC (eth1) is not assigned an IP address on the host.

so you are using network namespaces then?

because Linux-VServer by default uses network isolation,
in which case the host always has _all_ the IPs assigned
(those host only as well as all guest IPs)

> - The VServer is assigned eth1 as its one and only NIC.
> /etc/vservers/myserver/interfaces/0/dev ./ip and ./prefix are set to
> "eth1", "192.168.3.x", and "24" respectively.

that doesn't mean that you 'assign' eth1 to anything,
on the contrary, it only means that the IP (192.168.3.x)
will be _assigned_ to eth1, when the guest is started
(and removed from eth1 on guest shutdown)

> - Now, when the VServer is started, something "interesting" happens -
> Even though eth0 is not activated, it shows up with "ip route show",
> though as "if1"

that is fine, as a route exists to the interface which
is relevant for that guest

> 192.168.3.0/24 dev eth1 proto kernel scope link src 192.168.3.x
> 192.168.1.0/24 dev if1 proto kernel scope link src 192.168.1.x
> 127.0.0.0/8 dev if3 scope link
> default via 192.168.1.x dev if1

> Especially annoying is the fact that the default gateway is the one
> of the Vserver Host. No wonder it doesn't work.

again, for network isolation that is expected, you'll
need to setup multiple routing tables to have a different
default gateway for the guest IPs ...

> I could change the routing on the host, using "ip route del" and "ip
> route add". However that would mean to give the guest "NET_ADMIN"
> capability; which means it is a very bad idea.

in what way would that help and why does the guest need
NET_ADMIN if you change something on the host?

> I feel I'm missing something very basic about either VServers or
> Advanced Routing :)

probably, my guess would be network isolation vs network
context (and thus virtual network stack as used in qemu or
similar)

> What am I doing wrong?

> I'm using Versions:
> Kernel: 2.6.22-vs2.2.0.7-gentoo
> VS-API: 0x00020200
> util-vserver: 0.30.215; Jan 13 2010, 12:12:31

quite old kernel, ancient tools, so all you have here is
IP isolation (network contexts require quite recent kernels,
patches and util-vserver to get them working)

HTH,
Herbert

> Thanks for any help or pointers,
> Marcus
Received on Sat Sep 4 05:03:37 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sat 04 Sep 2010 - 05:03:37 BST by hypermail 2.1.8