Re: [vserver] Virtual Host-Only Networking (tap?)

From: Gordan Bobic <gordan_at_bobich.net>
Date: Sat 11 Sep 2010 - 11:19:07 BST
Message-ID: <4C8B579B.1040601@bobich.net>

On 09/11/2010 10:27 AM, Adrian Reyer wrote:
> On Sat, Sep 11, 2010 at 08:28:41AM +0800, Jeff Jansen wrote:
>> We use the 'dummy' interface for this. 'modprobe dummy' and now you've
>> got 'dummy0' as an interface on the host. (You can also have dummy1,
>> dummy2, etc. by running 'modprobe numdummies=X' where 'X' is the number
>> of dummy interfaces you want.)
>
> We use 'lo:N' here and a private address range. What is the benefit of
> 'dummy'? Basic setup just nanmes 'lo' as
> /etc/vservers/NAME/interfaces/X/dev.

Interesting, this is exactly what I was thinking about myself initially,
something like loopback interfaces on the same subnet, but I read
somewhere that vserver guests' loopbacks either get transparently
rewritten to the primary IP or that they get remapped to 127.a.b.1 where
ab is the 16-bit context ID. If that is the case, then:

1) Does that mean I cannot/shoudn't use 127.0.0.0/8 range for the
loobpack "network" for risk of IP clashes? From the host, ping returns
packets for ANY address in the 127/8 range, and if I try ssh-ing to
127.x.y.1, the port is closed (host is only listening on it's own
address). So it seems some additional magic is going on.

2) I've found I don't actually need explicit devX:Y NIC aliases on the
host to get networking to work. I can assign the guest an IP from the
same subnet on the primary interface without aliases and it works fine,
I can get ssh in and out of the guest. Can anyone explain what the deal
is there? Is the devX:Y alias requirement a deprecated bit of
documentation or am I doing something that is likely to cause me
problems? Or am I misreading the docs, and the alias is only required if
the NIC isn't already on the same subnet as the guests?

3) Would using lo fully expose the hosts's loopback interface, and if
so, is it firewallable in the normal way?

I'm really curious now regarding the pros and cons of lo vs. dummy
interfaces for private host-only networking.

And Adrian, are you implying that you are using non-127/8 address in lo
aliases?

>> You can treat this just like any other interface on the host and assign
>> a different IP address to each guest and you have a truly host-only
>> networking device.
>
> Does this make the hosts iptables passing the 'FORWARD' chain? 'lo'
> won't.

Is there a particular reason to use the FORWARD chain rather than the
INPUT chain?

Gordan
Received on Sat Sep 11 11:21:21 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Sat 11 Sep 2010 - 11:21:22 BST by hypermail 2.1.8