AW: AW: [vserver] IPtables, network namespaces

From: Fiedler Roman <Roman.Fiedler_at_ait.ac.at>
Date: Wed 21 Mar 2012 - 15:02:58 GMT
Message-ID: <9F69795E29C890408AC2DAF646C89BB379D161DBB5@MAILBOX.arc.local>

Hello Rod,

> -----Ursprüngliche Nachricht-----
> Von: Roderick A. Anderson [mailto:raanders42@gmail.com]
> Gesendet: Mittwoch, 21. März 2012 15:04
> An: vserver@list.linux-vserver.org
> Betreff: Re: AW: [vserver] IPtables, network namespaces
>
> Fiedler Roman wrote:
> > Hello Christian,
> >
> > Full Network stack separation is not possible, but with newer kernel iptables
> for guest separation are working and I'm using them quite frequently.
> >
> > Since guest cannot add new rules, all rules are created on host. Rules for
> guests are in different files so that removal of rules together with guest is
> easier.
> >
> > Tell me, if you are interested in (very simple) config examples
>
> I think many of us are interested. The LV systems I admin tend to run
> servers (MX, NS, etc.) but there is some interest in providing guests
> for clients.
>
> Yes please either post or but on the site.

It is really not very sophisticated:

* A simple debian package contains sysv-init script (/etc/init.d/iptablesfirewall) with 80 lines. The init script uses config-dir in etc with basic iptables configuration and a directory with plain shell scripts (confparts):

/etc/init.d/iptablesfirewall:
#!/bin/sh
# start/stop the iptables firewall. When started, this script will
# load a base iptables config and run addon scripts to complete
# the configuration.
#
# Stop does not do anything at the moment.
#
# V2008-01-17

_init_confDir=/etc/local/iptablesfirewall
_init_varRunDir=/var/run/iptablesfirewall

if [ ! -d "${_init_confDir}" ]; then
  echo "Cannot find iptables configuration"
  exit 1
fi

. "${_init_confDir}/config"

if [ "${IptablesFirewallStart}" != "yes" ]; then
  echo "IptablesFirewall start disabled. Complete your configuration and edit ${_init_confDir}/config"
  exit 1
fi

case "$1" in
  start)
    echo -n "Starting iptablesfirewall: "

# Place a lock in /var/run
    mkdir -p -- "${_init_varRunDir}"
    if ! dotlockfile -l -p -r 100 "${_init_varRunDir}/start.lock"; then
      logger -i -t iptablesfirewall -- "Stale lock at start, ignoring it"
# Proceed anyway with restart, quite likely that firwall start
# completely last time
    fi

    if test -f "${_init_confDir}/modules"; then
      cat -- "${_init_confDir}/modules" | grep -v -E -e '^(#| *$)' | \
          while read moduleName; do
        if ! modprobe "${moduleName}"; then
          echo "Failed to load ${moduleName}" >&2
        fi
      done
    fi

    iptables-restore < "${_init_confDir}/Iptables-Base"
    if [ "${IptablesFirewallFilterIpv6}" = "yes" ]; then
      ip6tables-restore < "${_init_confDir}/Ip6tables-Base"
    elif test -e /proc/sys/net/ipv6/conf/all/disable_ipv6; then
# Make sure to disable it, when not needed
      echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
    fi
    run-parts --exit-on-error "${_init_confDir}/confparts"
    _init_status="$?"

    dotlockfile -u -p "${_init_varRunDir}/start.lock"
    if [ "${_init_status}" = "0" ]; then
      echo "done."
    else
      echo "FAIL"
     exit "${_init_status}"
    fi
    ;;
  stop)
    echo -n "Stopping iptables: "
    echo "done."
    ;;
  restart)
    "$0" stop
    "$0" start
    ;;
  *)
    echo "Usage: $0 {start|stop|restart}"
    exit 1
    ;;
esac


The iptables base rules just perform minimal init of default chains and logging, e.g.


# Standard error chain: log, drop packet
-A DROP-ERROR -j LOG --log-ip-options --log-prefix "iptables:DROP-ERROR " --log-uid
-A DROP-ERROR -j DROP

##############################################################################
# Forward filtering
-A FORWARD -m state --state ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED -j ACCEPT-INFO
-A FORWARD -j DROP-ERROR

....

* Configuration scripts add the new iptables rules. Runparts will just run them one after another, e.g. script confparts/30VsSomeprojectApplication


#!/bin/bash -e
# This script contains the rules for the application server

. /etc/local/iptablesfirewall/config

# Get loopback IP of guest
_setup_context="$(cat -- "/etc/vservers/vs-someproject-application/context")"
_setup_loopbackBase="127.$((${_setup_context}>>8)).$((${_setup_context}%256))"
_setup_loopbackIp="${_setup_loopbackBase}.1"
_setup_loopbackNet="${_setup_loopbackBase}.0/24"

_setup_localVirtIp="${LocalVirtVsSomeprojectApplicationIp}"

# Example for guest-only connection

# Allow local access from
# * Apache to tomcat (8080)
iptables -A OUTPUT-LOCAL --source "${_setup_loopbackIp}" --destination "${_setup_loopbackIp}" -p tcp -m multiport --dports 8080 -m conntrack --ctstate NEW -j ACCEPT-INFO-TCP
iptables -A INPUT-LOCAL --source "${_setup_loopbackIp}" --destination "${_setup_loopbackIp}" -p tcp -m multiport --dports 8080 -m conntrack --ctstate NEW -j ACCEPT-INFO-TCP

# Example inter-guest connection

# Allow access from application server
iptables -A OUTPUT-LOCAL --source "${_setup_localVirtIp}" --destination "${LocalVirtVsSomeprojectStorageIp}" -p tcp -m multiport --dports 5432,8080 -m conntrack --ctstate NEW -j ACCEPT-INFO-TCP


# Example for incoming connection (this needs natting since all vserver are only bound to host-internal IPs not exposed via external interface

# Allow external access to tomcat server
iptables -t nat -A PREROUTING -i "${MainInterfaceName}" --destination "${MainInterfaceIp}" -p tcp -m tcp --dport 8080 -j DNAT --to-destination "${LocalVirtVsSomeprojectApplicationIp}"
iptables -A INPUT-GLOBAL -i "${MainInterfaceName}" --destination "${LocalVirtVsSomeprojectApplicationIp}" -p tcp -m tcp --dport 8080 -m conntrack --ctstate NEW --ctorigdst "${MainInterfaceIp}" -j ACCEPT-INFO-TCP





* The scripts use common config file, which is just simple shell script again (/etc/local/iptablesfirewall/config)

# Minimal IptablesFirewall configuration

# If set to yes, then the iptables firewall can be started. Only
# set flag when you have finished the complete configuration.
IptablesFirewallStart=yes

# If set to yes, IptablesFirewall will install a basic ipv6
# filtering configuration that will block all traffic, otherwise
# ipv6 is disabled via /proc/sys/net/ipv6/conf/all/disable_ipv6
IptablesFirewallFilterIpv6=no

MainInterfaceName=eth0
MainInterfaceIp=10.xx.xx.xx
MainInterfaceNet=10.xx.xx.0/24

LocalVirtInterfaceNet=10.yy.yy.0/24
LocalVirtVsSomeprojectApplicationIp=10.yy.yy.2
LocalVirtVsSomeprojectStorageIp=10.yy.yy.3

NtpServerIps="10.xx.xx.xx ...




That’s all. Everything else is in the firewall config shell scripts, some of them generated automatically during deployment. As you may have noted, this example has very flat chain hierarchy. With more firewall rules, creation of subchains is good idea, e.g. OUTPUT-LOCAL OUTPUT-LOCAL-PROJ-A ...

Regards,
Roman


Received on Wed Mar 21 15:03:20 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 21 Mar 2012 - 15:03:20 GMT by hypermail 2.1.8