Subject: Re: [vserver] host-IP substituted by guest-IP ???
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Sat, 15 Aug 2009 21:55:48 +0200

On Sat, Aug 15, 2009 at 09:06:35PM +0200, Jarry wrote:
> Hi,
> 
> I'm still quite new to this vserver-concept, so maybe I'm asking
> a really stupid question, but I have a problem to understand how
> networking between "host" and "guests" works. An example:

> I have vserver-host, with IP 192.168.1.10,
> and I have vserver-guest, with IP 192.168.1.14 (running bind).

> When I contact bind from vserver-host, in bind-logs I see:
> ".... queries: info: client 192.168.1.14#32768: query: ...."

> Should not be there 192.168.1.10 as client-IP? As I said,
> I made this query from vserver-host which has IP 192.168.1.10

> I see the same with ftp-server, which is running on different
> vserver-guest (IP 192.168.1.12): I made connection from host,
> but in ftp-logs I see "...CONNECT: Client "192.168.1.12"..."

> BTW, this is only for host<->guest communication. Whenever
> I connect from one guest to the other, there are correct
> clients' IP-addresses in log...

> It seems to me that for every connection from host, vserver-guest
> is substituting host's IP with its own guest's IP. WHY???

while it might seem so, this is a misconception :)


Linux-Vserver, contrary to other, heavier virtualization
technologies, uses network isolation, to provide top notch
performance with minimal overhead, but there are some
differences to a routed or bridged setup one has to under-
stand to use it properly:

 - there are no 'host' or 'guest' IPs or even interfaces
   all addresses are configured on the host, and all
   networking happens on the host, the guests just get to
   'use' certain IPs for binding services to them

 - from the host perspective, all IPs (even those assigned
   to a guest) are local, so it is like the host is talking
   to itself.

so, that means for your setup:

 - all host-guest or guest-guest traffic is local traffic
   which doesn't leave the host, and uses lo to transfer
 - binding to 0.0.0.0 on the host will grab all IPs,
   including those assigned to guests
 - source IP selection will happen according to the
   normal Linux network stack rules

> Can I somehow force guests to use correct host's IP?

the guest is not involved in your source IP selection, so
nothing in the guest (or its configuration) can affect that
the problem is with the host finding a suitable IP for your
host local request, and as you do not give any preference
the host chooses one address according to its rule set,
which might as well be the IP assigned to your guest

you can use the 'normal' mechanism to control the source
IP selection, or you can specify the source IP on your
query, in any case, as long as the guest is reachable, it
will work out fine

HTC,
Herbert

> Jarry
> 
> -- 
> _______________________________________________________________
> This mailbox accepts e-mails only from selected mailing-lists!
> Everything else is considered to be spam and therefore deleted.