Hello Rod,
> -----Ursprüngliche Nachricht-----
> Von: Roderick A. Anderson [mailto:raanders42@gmail.com]
> Gesendet: Mittwoch, 21. März 2012 15:04
> An: vserver@list.linux-vserver.org
> Betreff: Re: AW: [vserver] IPtables, network namespaces
>
> Fiedler Roman wrote:
> > Hello Christian,
> >
> > Full Network stack separation is not possible, but with newer kernel iptables
> for guest separation are working and I'm using them quite frequently.
> >
> > Since guest cannot add new rules, all rules are created on host. Rules for
> guests are in different files so that removal of rules together with guest is
> easier.
> >
> > Tell me, if you are interested in (very simple) config examples
>
> I think many of us are interested. The LV systems I admin tend to run
> servers (MX, NS, etc.) but there is some interest in providing guests
> for clients.
>
> Yes please either post or but on the site.
It is really not very sophisticated:
* A simple debian package contains sysv-init script (/etc/init.d/iptablesfirewall) with 80 lines. The init script uses config-dir in etc with basic iptables configuration and a directory with plain shell scripts (confparts):
/etc/init.d/iptablesfirewall:
#!/bin/sh
# start/stop the iptables firewall. When started, this script will
# load a base iptables config and run addon scripts to complete
# the configuration.
#
# Stop does not do anything at the moment.
#
# V2008-01-17
_init_confDir=/etc/local/iptablesfirewall
_init_varRunDir=/var/run/iptablesfirewall
if [ ! -d "${_init_confDir}" ]; then
echo "Cannot find iptables configuration"
exit 1
fi
. "${_init_confDir}/config"
if [ "${IptablesFirewallStart}" != "yes" ]; then
echo "IptablesFirewall start disabled. Complete your configuration and edit ${_init_confDir}/config"
exit 1
fi
case "$1" in
start)
echo -n "Starting iptablesfirewall: "
# Place a lock in /var/run
mkdir -p -- "${_init_varRunDir}"
if ! dotlockfile -l -p -r 100 "${_init_varRunDir}/start.lock"; then
logger -i -t iptablesfirewall -- "Stale lock at start, ignoring it"
# Proceed anyway with restart, quite likely that firwall start
# completely last time
fi
if test -f "${_init_confDir}/modules"; then
cat -- "${_init_confDir}/modules" | grep -v -E -e '^(#| *$)' | \
while read moduleName; do
if ! modprobe "${moduleName}"; then
echo "Failed to load ${moduleName}" >&2
fi
done
fi
iptables-restore < "${_init_confDir}/Iptables-Base"
if [ "${IptablesFirewallFilterIpv6}" = "yes" ]; then
ip6tables-restore < "${_init_confDir}/Ip6tables-Base"
elif test -e /proc/sys/net/ipv6/conf/all/disable_ipv6; then
# Make sure to disable it, when not needed
echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
fi
run-parts --exit-on-error "${_init_confDir}/confparts"
_init_status="$?"
dotlockfile -u -p "${_init_varRunDir}/start.lock"
if [ "${_init_status}" = "0" ]; then
echo "done."
else
echo "FAIL"
exit "${_init_status}"
fi
;;
stop)
echo -n "Stopping iptables: "
echo "done."
;;
restart)
"$0" stop
"$0" start
;;
*)
echo "Usage: $0 {start|stop|restart}"
exit 1
;;
esac
The iptables base rules just perform minimal init of default chains and logging, e.g.
# Standard error chain: log, drop packet
-A DROP-ERROR -j LOG --log-ip-options --log-prefix "iptables:DROP-ERROR " --log-uid
-A DROP-ERROR -j DROP
##############################################################################
# Forward filtering
-A FORWARD -m state --state ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED -j ACCEPT-INFO
-A FORWARD -j DROP-ERROR
....
* Configuration scripts add the new iptables rules. Runparts will just run them one after another, e.g. script confparts/30VsSomeprojectApplication
#!/bin/bash -e
# This script contains the rules for the application server
. /etc/local/iptablesfirewall/config
# Get loopback IP of guest
_setup_context="$(cat -- "/etc/vservers/vs-someproject-application/context")"
_setup_loopbackBase="127.$((${_setup_context}>>8)).$((${_setup_context}%256))"
_setup_loopbackIp="${_setup_loopbackBase}.1"
_setup_loopbackNet="${_setup_loopbackBase}.0/24"
_setup_localVirtIp="${LocalVirtVsSomeprojectApplicationIp}"
# Example for guest-only connection
# Allow local access from
# * Apache to tomcat (8080)
iptables -A OUTPUT-LOCAL --source "${_setup_loopbackIp}" --destination "${_setup_loopbackIp}" -p tcp -m multiport --dports 8080 -m conntrack --ctstate NEW -j ACCEPT-INFO-TCP
iptables -A INPUT-LOCAL --source "${_setup_loopbackIp}" --destination "${_setup_loopbackIp}" -p tcp -m multiport --dports 8080 -m conntrack --ctstate NEW -j ACCEPT-INFO-TCP
# Example inter-guest connection
# Allow access from application server
iptables -A OUTPUT-LOCAL --source "${_setup_localVirtIp}" --destination "${LocalVirtVsSomeprojectStorageIp}" -p tcp -m multiport --dports 5432,8080 -m conntrack --ctstate NEW -j ACCEPT-INFO-TCP
# Example for incoming connection (this needs natting since all vserver are only bound to host-internal IPs not exposed via external interface
# Allow external access to tomcat server
iptables -t nat -A PREROUTING -i "${MainInterfaceName}" --destination "${MainInterfaceIp}" -p tcp -m tcp --dport 8080 -j DNAT --to-destination "${LocalVirtVsSomeprojectApplicationIp}"
iptables -A INPUT-GLOBAL -i "${MainInterfaceName}" --destination "${LocalVirtVsSomeprojectApplicationIp}" -p tcp -m tcp --dport 8080 -m conntrack --ctstate NEW --ctorigdst "${MainInterfaceIp}" -j ACCEPT-INFO-TCP
* The scripts use common config file, which is just simple shell script again (/etc/local/iptablesfirewall/config)
# Minimal IptablesFirewall configuration
# If set to yes, then the iptables firewall can be started. Only
# set flag when you have finished the complete configuration.
IptablesFirewallStart=yes
# If set to yes, IptablesFirewall will install a basic ipv6
# filtering configuration that will block all traffic, otherwise
# ipv6 is disabled via /proc/sys/net/ipv6/conf/all/disable_ipv6
IptablesFirewallFilterIpv6=no
MainInterfaceName=eth0
MainInterfaceIp=10.xx.xx.xx
MainInterfaceNet=10.xx.xx.0/24
LocalVirtInterfaceNet=10.yy.yy.0/24
LocalVirtVsSomeprojectApplicationIp=10.yy.yy.2
LocalVirtVsSomeprojectStorageIp=10.yy.yy.3
NtpServerIps="10.xx.xx.xx ...
That’s all. Everything else is in the firewall config shell scripts, some of them generated automatically during deployment. As you may have noted, this example has very flat chain hierarchy. With more firewall rules, creation of subchains is good idea, e.g. OUTPUT-LOCAL OUTPUT-LOCAL-PROJ-A ...
Regards,
Roman
Received on Wed Mar 21 15:03:20 2012