On Mon, Jan 05, 2009 at 10:59:16PM +1100, Declan Mullen wrote: > Hi > > I want to do something which is probably very typical of virtual > servers. I believe there are at least two techniques to do it (see > below), but because I have not done it before I am not sure which > technique is best or if both techniques are possible. I hope some of > you can share your recommendations and why : > I wish to set up a virtual server host with several guests. Each guest > is to run a network service and I am intending on using the host's > iptables to limit access to and in between the host and the guests > and the other systems in the network. The network is a private subnet > and there is no shortage of available ip addresses. The host has only > one NIC (eth0). The only reason for running the network services in > separate guests rather than running them all in the host, is for > security. The network services are to include; apache2 web server, > exim4 email, apt-cacher, bit torrent, scalix email. > Initially I assumed the technique of building/configuring each guest > to use the host's eth0 interface with their own unique ip address in > the host's eth0 subnet. > Then having browsed the virtual-server.org site I found an alternative > technique of creating the dummy0 interface in the host with a > ip address in a subnet different to eth0's subnet, and then > building/configuring each guest to use the dummy0 interface with their > own unique ip address in the host's dummy0 subnet. yep, that's the usual way, but note that the dummy0 interface is there for cosmetical purposes, i.e. it is not used for anything except carrying the private IPs (you could as well put them on eth0) > And then allowing other systems in the network to access the network > services either by using the host as a simple router that doesn't work, as there is no routing involved between host and guest (they share the same stack) > or by setting up port/service forwarding from host to relevant guest. no forwarding either, but S/DNAT is the way to map the shared public IP to private IPs carrying the actual services ... > Are there any particular reasons why I should use the dummy0 technique > rather than the simpler eth0 technique ? simple eth0 technique being? if you mean, separate public IP for each guest ... well the advantage is that you can do IP specific stuff like ssl .. the disadvantage is that you need more public IPs, in general the mapping to private IPs has certain advantages in itself, mainly that you are able to switch between different guests by simply chaning the S/DNAT rule > BTW, I'm using the current Debian Lenny distribution and its virtual > server kernel image (version "2.6.26+17") with its virtual server > version "2.3" and the "util-vserver" version is "0.30.216~r2772-4". ~~~~~~~~~~~~~~~~~~~~~ better update that one, because this version is broken > The "uname -a" output is "Linux max 2.6.26-1-vserver-686 #1 SMP Mon > Dec 15 21:11:05 UTC 2008 i686 GNU/Linux". > Thanks, > Declan best, Herbert