Re: [vserver] change net.ipv4.ip_local_port_range for specific guest

From: Art -kwaak- van Breemen <ard_at_telegraafnet.nl>
Date: Wed 12 Dec 2012 - 12:25:09 GMT
Message-ID: <20121212122508.GA10127@telegraafnet.nl>

On Wed, Dec 12, 2012 at 12:53:02PM +0100, Herbert Poetzl wrote:
> > How can I change net.ipv4.ip_local_port_range only for specific guest?
>
> maybe by utilizing a network namespace, but no guarantees there

I know that at least tcp_keepalive_time is global.
harry:/proc/sys/net/ipv4# echo 32767 61000 > ip_local_port_range
harry:/proc/sys/net/ipv4# cat ip_local_port_range
32767 61000
harry:/proc/sys/net/ipv4# vspace -e v1012 --net cat ip_local_port_range
32767 61000

so local-port-range is global too.
Iptables is per network namespace though...
(The modules are global, so keep an eye on your conntrack per
network namespace, it might be way too low).

Anyway: to answer the question in another way:
You should always expand the ip_local_port_range, since the
local_port_range is actually shared.
You will not have enough local ports if you are going to connect
to a vserver on the same hosts. It seems that if the traffic is
host local, linux will prevent using same source ports, even if
the local source address is different. (In tcp the
sourceip:sourceport destinationip:destinationport should be
unique. It seems like if you do local traffic, it's more like
sourceport destinationport that must be unique, at least for
time_wait).
This matters if you have haproxy and varnish on the same host
connecting to eachother. Of course when having seperate network
namespaces (which means seperate ip stacks) it doesn't matter.
Received on Wed Dec 12 12:25:44 2012

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 12 Dec 2012 - 12:25:44 GMT by hypermail 2.1.8