Re: [vserver] Additional internal-only IP on loopback

From: Gordan Bobic <gordan_at_bobich.net>
Date: Wed 22 Sep 2010 - 10:21:53 BST
Message-ID: <4C99CAB1.3000100@bobich.net>

Art -kwaak- van Breemen wrote:
> Hi,
>
> On Wed, Sep 22, 2010 at 09:40:02AM +0100, Gordan Bobic wrote:
>> Doesn't this contradict what has already been said on this thread,
>> that guests-only networking can be done by assigning IPs on
>> loopback? If I add an IP 192.168.0.1/32, then this will not be able
>> to access 192.168.0.2/32 on another guest without routing, right?
>> And somebody said that using a dummy interface will just end up
>> getting re-written to lo. So, what is the right way to do an
>> internal guests-only "vlan" with vserver?
>
> Fortunately everything is much simpler within linux :-).
> Globally:
> 1) there is only one ipstack (*)
> 2) ip addresses are global to this ip stack, no matter on which
> interface
> 3) ip addresses on interfaces with subnets are only there as a
> shortcut for the routing table. You can just as wel add device
> routes to the ipstack.
> 4) For a device to matter to the ipstack it needs to have at
> least 1 IPv4 address. This can be 127.0.0.1/32 if you like ;-).
> Without it, the devicehandler won't send packets to the ipstack.
>
> Exceptions:
> 5) subnets on lo are a shortcut to say you *have* all those
> IP addresses in that subget. So your ipstack will answer any
> address discovery (ARP) for any ip in that subnet. There is no
> other meaning for a subnet on lo.
> This is different from a subnet on a real device: on a real
> device it just means that that subnet is reachable through that
> device. The ipstack doesn't hold all ip addresses, and hence
> won't answer arps for it.
> 6) 127.0.0.0/8 is an exception in the routing code. Without this
> exception, you would be perfectly able to route 127.0.0.0/8 out
> of a device.
>
> Vserver:
> Vserver network contexts are more or less filters on the ip's
> available on the host.
>
> *) To be complete you can have network namespaces which are
> complete ipstacks in itself. Just forget them for now.
>
>
> Going back to your problem: defining 192.168.0.1/32 and
> 192.168.0.2/32 on any device just adds those 2 addresses to the
> ipstack, and hence will make all routing local. ("Going over lo")
> So you don't need an extra device.

That is a most excellent, comprehensive explanation. Thanks. :)

Gordan
Received on Wed Sep 22 10:22:03 2010

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 22 Sep 2010 - 10:22:03 BST by hypermail 2.1.8