Re: AW: [vserver] Using loopback for guest-guest and guest-host communication but still remapping

From: Gordan Bobic <gordan_at_bobich.net>
Date: Wed 29 Feb 2012 - 12:22:46 GMT
Message-ID: <4F4E1896.2080909@bobich.net>

Fiedler Roman wrote:
>> -----Ursprüngliche Nachricht-----
>> Von: Gordan Bobic [mailto:gordan@bobich.net]
>> Gesendet: Mittwoch, 29. Februar 2012 12:43
>> An: vserver@list.linux-vserver.org
>> Betreff: Re: [vserver] Using loopback for guest-guest and guest-host
>> communication but still remapping
>>
>> Fiedler Roman wrote:
>>> Hi,
>>>
>>> I'm trying to configure networking on a machine, where we cannot use any
>> private network for internal communication because I might need to receive
>> traffic from that network. So I can only use loopback, one private IP-Range IP
>> (server external IP) and I do not want to grab one public IP-range for internal
>> communication if avoidable.
>>> Is this configuration with special combination of nflags and dev settings
>> possible (CAVEAT: network prefixes atypical)?
>>> * Guest ctx=3: Inside guest bind and connect to 127.0.0.1/24 is remapped
>> to 127.0.3.1 and stays inside guest
>>> * Guest ctx=4: Inside guest bind and connect to 127.0.0.1/24 is remapped
>> to 127.0.4.1 and stays inside guest
>>> * Guest ctx=3: Inside guest connect to 127.0.4.1/24 goes to guest ctx=4
>> network stack (inter-guest comm)
>>> * Guest ctx=4: Inside guest connect to 127.0.3.1/24 goes to guest ctx=3
>> network stack (inter-guest comm)
>>> * Guest ctx=3,4: Inside guest connects to any loopback IP-Range not bound
>> to any guest goes to host, e.g. 127.255.255.1 (if something is listening on host
>> on that IP/port)
>>>
>>> If not, would a special nflags, dev config configuration together with a
>> modification of vserver patch (change 127.0.0.0/8 to 127.0.0.0/24
>> somewhere) be sufficient?
>>
>> I solved that problem by using a dummy interface for each internal-only
>> network. You set up a dummy interface on the host, and give the guests
>> an IP on that interface.
>
> I did a quick try of 10 configurations, but failed to get it working
> in combination with remap. How did your network config look like? Special
> nflags? Special kernel version or util-vservers?

No, nothing special at all. Just create a dummy0 interface on the host,
and each give each guest an IP on that interface. No remap required.

> The one I'm trying to work on is (after startup of guest):
>
> Host:
> ~# ip addr show
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> inet 127.0.0.1/24 scope host lo
> inet 127.0.2.1/24 brd 127.0.2.255 scope host lo
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
> inet 192.168.0.2/24 scope global eth0
> 3: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
> inet 127.0.1.1/24 brd 127.0.1.255 scope host dummy0
> inet 127.0.1.2/24 brd 127.0.1.255 scope host secondary dummy0
>
> Guest vserver config:
>
> nflags:
> ~single_ip,lback_allow
>
> Dev 0: lo, 127.0.2.1/24 (context is 2)
> Dev 1: dummy0, 127.0.1.2/24
>
> Guest ip addrs:
> /# ip addr show
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
> link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> inet 127.0.0.1/24 scope host lo
> inet 127.0.2.1/24 brd 127.0.2.255 scope host lo
> 3: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
> link/ether 02:98:d9:0e:bd:a1 brd ff:ff:ff:ff:ff:ff
> inet 127.0.1.2/24 brd 127.0.1.255 scope host secondary dummy0
>
> Connect from guest to 127.0.1.1:80 is still remapped to 127.0.2.1, which is
> guest itself. So no connection to host via lo possible.

You are using 127/8 subnet on the dummy device - that won't work. You
need a non-loopback IP range on the dummy interface, e.g. 192.168/16.

Gordan
Received on Wed Feb 29 12:22:57 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 29 Feb 2012 - 12:22:57 GMT by hypermail 2.1.8