On Sat, Sep 11, 2010 at 11:19:07AM +0100, Gordan Bobic wrote: > And Adrian, are you implying that you are using non-127/8 address in > lo aliases? Yes, I use some 10.99.X.Y/24 on my hosts. I never set them up manually, I let util-vserver do that part, the 'dev' is just 'lo', as I add a name there as well, I end up with something like: inet 10.99.254.2/24 brd 10.99.254.255 scope global secondary lo:mysql on the host. 'ifconfig' within the guest says: lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:3444093014 errors:0 dropped:0 overruns:0 frame:0 TX packets:3444093014 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:912504932956 (849.8 GiB) TX bytes:912504932956 (849.8 GiB) lo:mysql Link encap:Local Loopback inet addr:10.99.254.2 Mask:255.255.255.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 I use iptables and SNAT/DNAT to make the VServers accessible from the outside where needed, normal firewalling to everthing outside that piece of hardware works as well. Firewalling within the same hardware, different VServers has the usual flaws and I just don't use it. Be aware I don't use VServers for security reasons, but to be able to administrate e.g. the webserver seperate from the database server, despite both are small enough to run on the same host. I don't run e.g. potentially hostile webservers on my hosts. So any security flaws that relate to inner-VServer/host are no real concern to me and I actually only spent minor thoughts on it. Network-inner-kernel-routing-wise that is. I trust VServer to handle all the context/namespace stuff fine. But Kernel routing really does some unexpectant things some time. I doubt that would be different with dummy interfaces. If you don't want a VSevrer to access a physical network the host is in, move it to a host with no physical access. Though I understood there are patches/enhancements out there that focus more on the network stuff. > >Does this make the hosts iptables passing the 'FORWARD' chain? 'lo' > >won't. > Is there a particular reason to use the FORWARD chain rather than > the INPUT chain? Basically: no Just if your VServer-Host is same time some sort of gateway, you need to set up generic rules for FORWARD and INPUT/OUTPUT. Mostly a cosmetical issue. Regards, Adrian -- LiHAS - Adrian Reyer - Hessenwiesenstraße 10 - D-70565 Stuttgart Fon: +49 (7 11) 78 28 50 90 - Fax: +49 (7 11) 78 28 50 91 Mail: lihas@lihas.de - Web: http://lihas.de Linux, Netzwerke, Consulting & Support - USt-ID: DE 227 816 626 Stuttgart