Re: [vserver] Best way for private networking between guests

From: Art -kwaak- van Breemen <>
Date: Mon 22 Apr 2013 - 16:46:55 BST
Message-ID: <>


On Sun, Apr 21, 2013 at 10:02:59PM +0200, Herbert Poetzl wrote:
> On Fri, Apr 19, 2013 at 08:04:01PM +0200, Art -kwaak- van Breemen wrote:
> > But remember: that "network" will not be private.
> > It will be accessible by any interface on the server.
> again, depends on the configuration, for example
> rp_filter and routing tables can easily prevent
> certain interfaces from advertising certain IPs
> and of course, from responding to any packets.

It will wreck havoc. The right settings are not rp_filter but
arp_ignore. If you do not change arp_ignore to at least 1, you
will gladly answer for any arp on any interface destined for any
IP you think you might have ;-).
Host: "Who has the this ip (which is the gateway ip)"
You: "That's me! me! (arp-ignore=0)"

To make matters worse: you can accidently update a neighbours
table with a VIP adres if your arp_announce is set too low :-).
That's why I have vlarp: to update neighbour tables (and to
prevent unicast flooding):

rp_filter only comes after that:
Host: "here is my data, well actually from a vip you don't know
You: "I don't know about that. I drop it".

And: multiple routing tables are only about routing :-). You must
dose your teachings in small portions:
Teaching 1)
See and behold the beauty and the simplicity of the ip stack.
Teaching 2)
See and understand the beauty of multiple routing tables.
Teaching 3)
Understand teachings 1 and 2 when you put them in seperate
network namespaces :-).

(Yes, I have multiple routing tables in multiple network
namespaces and am using network contexts too).

Received on Mon Apr 22 16:47:03 2013

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 22 Apr 2013 - 16:47:03 BST by hypermail 2.1.8