Re: [vserver] Virtual Host-Only Networking (tap?)

On Sat, Sep 11, 2010 at 11:19:07AM +0100, Gordan Bobic wrote:
> And Adrian, are you implying that you are using non-127/8 address in
> lo aliases?

Yes, I use some 10.99.X.Y/24 on my hosts.
I never set them up manually, I let util-vserver do that part, the 'dev'
is just 'lo', as I add a name there as well, I end up with something
like:
    inet 10.99.254.2/24 brd 10.99.254.255 scope global secondary lo:mysql
on the host.
'ifconfig' within the guest says:
lo Link encap:Local Loopback
          inet addr:127.0.0.1 Mask:255.0.0.0
          UP LOOPBACK RUNNING MTU:16436 Metric:1
          RX packets:3444093014 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3444093014 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:912504932956 (849.8 GiB) TX bytes:912504932956 (849.8 GiB)

lo:mysql Link encap:Local Loopback
          inet addr:10.99.254.2 Mask:255.255.255.0
          UP LOOPBACK RUNNING MTU:16436 Metric:1

I use iptables and SNAT/DNAT to make the VServers accessible from the
outside where needed, normal firewalling to everthing outside that piece
of hardware works as well. Firewalling within the same hardware,
different VServers has the usual flaws and I just don't use it. Be aware
I don't use VServers for security reasons, but to be able to
administrate e.g. the webserver seperate from the database server,
despite both are small enough to run on the same host. I don't run
e.g. potentially hostile webservers on my hosts. So any security flaws
that relate to inner-VServer/host are no real concern to me and I
actually only spent minor thoughts on it.
Network-inner-kernel-routing-wise that is. I trust VServer to handle all
the context/namespace stuff fine. But Kernel routing really does some
unexpectant things some time. I doubt that would be different with dummy
interfaces. If you don't want a VSevrer to access a physical network the
host is in, move it to a host with no physical access. Though I
understood there are patches/enhancements out there that focus more on
the network stuff.

> >Does this make the hosts iptables passing the 'FORWARD' chain? 'lo'
> >won't.
> Is there a particular reason to use the FORWARD chain rather than
> the INPUT chain?

Basically: no
Just if your VServer-Host is same time some sort of gateway, you need to
set up generic rules for FORWARD and INPUT/OUTPUT. Mostly a cosmetical
issue.

Regards,
        Adrian

-- 
LiHAS - Adrian Reyer - Hessenwiesenstraße 10 - D-70565 Stuttgart
Fon: +49 (7 11) 78 28 50 90 - Fax:  +49 (7 11) 78 28 50 91
Mail: lihas_at_lihas.de - Web: http://lihas.de
Linux, Netzwerke, Consulting & Support - USt-ID: DE 227 816 626 Stuttgart