Re: [vserver] Best way for private networking between guests

From: Art -kwaak- van Breemen <ard_at_telegraafnet.nl>
Date: Fri 19 Apr 2013 - 19:04:01 BST
Message-ID: <20130419180401.GA15975@telegraafnet.nl>

Hi,

On Thu, Apr 18, 2013 at 12:15:35PM +0200, Laurens Vets wrote:
> I was wondering what the best way is to configure a private network
> between guests. Would it be best to use a dummy device on the host
> or just an alias on the loopback interface in the guests?

I think the dummy device should be banned.
Nobody seems to really understand it.

if !( use network namespace) {

There is a single IP stack. Every ip on every interface,
it doesn't matter. One stack! Communications between those ip's
are *always* local.
An ip with a mask on an interface is only put there for routing
and arp purposes.
There are 2 exceptions to this rule:
1a) 127.0.0.0/8 has a special filtering in vanilla linux that can
be turned off. If turned off, you can use 127.0.0.0/8 on every
interface as normal routable ip addresses.
1b) 127.0.0.0/8 has a special filtering in vserver linux with a
network context (That's about 99.999999999% of those that read
this). If I am correct, under water it will be rewritten to
127.<networkcontextid>.1, which means the localhost of that
vserver.
2) network masks used on lo means you bind to *all* addresses in
that network. 127.0.0.0/8 means you can use 127.0.0.0 to
127.255.255.255 . 192.168.1.15/24 on lo means that you own every
ip address from 192.168.1.0 to 192.168.1.255 . That's an easy way
to kill a network, because you will have all those addresses, and
hence will respond to arp requests for all those addresses.

IPv6 is almost the same, except for arp (neighbour discovery).
Because the neigbour discovery in IPv6 works differently, you can
not put an ipv6 address on lo, and expect everything to work.
Your host will not respond to discovery. For that you need to add
a ipv6 proxy entry for that address on the correct interface. Or
you just add that ip address to that interface with the right
mask.
}

If you use network namespaces, all this applies *per* namespace.
Each namespace is a seperate ip stack following the same rules.

Hmmm:
http://www.paul.sladen.org/vserver/archives/201009/0109.html

Same answer: you don't need another interface.

But remember: that "network" will not be private. It will be
accessible by any interface on the server.
Received on Fri Apr 19 19:04:11 2013

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 19 Apr 2013 - 19:04:11 BST by hypermail 2.1.8