Re: [vserver] Network confusion

From: Art -kwaak- van Breemen <ard_at_telegraafnet.nl>
Date: Wed 13 Mar 2013 - 08:59:15 GMT
Message-ID: <20130313085914.GP1585@telegraafnet.nl>

On Mon, Mar 11, 2013 at 03:31:19PM +0000, Phil Daws wrote:
> The problem though is that the internal DNS is on a private IP and therefore requires the use of views. I did consider doing something like:
>
> -I PREROUTING 1 -j INTI ! -d 192.168.1.0/24
> -I POSTROUTING 1 -j INTO ! -s 192.168.1.0/24

Why? If it goes internal, it doesn't go out onto eth0, but onto
lo, which has nothing but really nothing to do with eth0.

So if you match on eth0, how would POSTROUTING ever affect your
internal traffic.

> so then it would not break inter guest communications. I hoped
> by putting the vserver guests into a vlan it would stop natting
> taking place.

That's a misconception. There is only 1 ip stack in your setup,
and all ip addresses belong to that ip stack. No matter if you
"put it on" eth0, or on lo, or dummy. Putting it on an interface
merely updates the routing table.
Iptables however knows the routing when it reaches POSTROUTING.
It knows if it goes out onto eth0. So match on that when doing a
SNAT. It won't SNAT internally then.

Regards,
Ard
Received on Wed Mar 13 08:59:23 2013

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 13 Mar 2013 - 08:59:23 GMT by hypermail 2.1.8