On Fri, May 27, 2011 at 12:15:28AM +0200, Thomas Weber wrote: > Hmm nobody cares? I care, but not sure what to say here. I am no expert in linux-vserver network handling, but I have quite some experience with shared physical network and different networks on top regarding iptables-code. The short statement is: avoid it. All sorts of things fail as the kernel sees things and takes conclusions on these. One thing is 'Proxy ARP', if this is enabled, your host will answer for all hosts on one interface it has a route to on some other interface. Given a client has a bad netmask you can basically communicate with all the hosts on the other nets without a routing table. Then there is the ip_spoofing protection, it drops packages which are thought to be on the wrong interface, you might be able to see them by enabling 'log_martians'. If you habe 2 interfaces on the same physical lan, one feels free to answer for IPs the other has, 'arp_filter' can fix this for you. In your previous post you stated 2 network interfaces, both of them having a default route. According to my experience this won't route a single packet via the other default route. If you want to make one host route via one default gateway and the other via the other one, you need to use multiple routing tables and set 'ip rule' stuff in suitable way. If 2 VServers on your host communicate with each other, no routing table is involved at all. No alternate routing table will get you out of this. None of these thinsg seem to be directly valid for your case, maybe they help in finden the real solution, though. Regards, Adrian -- LiHAS - Adrian Reyer - Hessenwiesenstraße 10 - D-70565 Stuttgart Fon: +49 (7 11) 78 28 50 90 - Fax: +49 (7 11) 78 28 50 91 Mail: lihas@lihas.de - Web: http://lihas.de Linux, Netzwerke, Consulting & Support - USt-ID: DE 227 816 626 Stuttgart