Re: [vserver] Additional internal-only IP on loopback

From: Art -kwaak- van Breemen <ard_at_telegraafnet.nl>
Date: Wed 22 Sep 2010 - 10:03:01 BST
Message-ID: <20100922090301.GS15321@telegraafnet.nl>

Hi,

On Wed, Sep 22, 2010 at 09:40:02AM +0100, Gordan Bobic wrote:
> Doesn't this contradict what has already been said on this thread,
> that guests-only networking can be done by assigning IPs on
> loopback? If I add an IP 192.168.0.1/32, then this will not be able
> to access 192.168.0.2/32 on another guest without routing, right?
> And somebody said that using a dummy interface will just end up
> getting re-written to lo. So, what is the right way to do an
> internal guests-only "vlan" with vserver?

Fortunately everything is much simpler within linux :-).
Globally:
1) there is only one ipstack (*)
2) ip addresses are global to this ip stack, no matter on which
interface
3) ip addresses on interfaces with subnets are only there as a
shortcut for the routing table. You can just as wel add device
routes to the ipstack.
4) For a device to matter to the ipstack it needs to have at
least 1 IPv4 address. This can be 127.0.0.1/32 if you like ;-).
Without it, the devicehandler won't send packets to the ipstack.

Exceptions:
5) subnets on lo are a shortcut to say you *have* all those
IP addresses in that subget. So your ipstack will answer any
address discovery (ARP) for any ip in that subnet. There is no
other meaning for a subnet on lo.
This is different from a subnet on a real device: on a real
device it just means that that subnet is reachable through that
device. The ipstack doesn't hold all ip addresses, and hence
won't answer arps for it.
6) 127.0.0.0/8 is an exception in the routing code. Without this
exception, you would be perfectly able to route 127.0.0.0/8 out
of a device.

Vserver:
Vserver network contexts are more or less filters on the ip's
available on the host.

*) To be complete you can have network namespaces which are
complete ipstacks in itself. Just forget them for now.

Going back to your problem: defining 192.168.0.1/32 and
192.168.0.2/32 on any device just adds those 2 addresses to the
ipstack, and hence will make all routing local. ("Going over lo")
So you don't need an extra device.
Received on Wed Sep 22 10:03:08 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 22 Sep 2010 - 10:03:08 BST by hypermail 2.1.8