Subject: Re: [vserver] guests to use dummy0 or eth0 ?
From: "Michael S. Zick" <mszick@morethan.org>
Date: Mon, 5 Jan 2009 07:58:00 -0600

On Mon January 5 2009, Declan Mullen wrote:
> Hi
> 

List, please bump the readership of the answer to this question
to two (2) - I have been meaning to ask the some one. ;)

@Declan - -

I have done both myself, when I first made use of Linux-VServer I
stacked all of the addresses on eth0.
After a several year break from L-VS I have recently setup another
machine to host guest contexts.
This time, I came across a L-VS article (Wiki?) that showed the
stacking of the addresses on dummy0.
Which is what I have done - I don't see any difference in my
simple uses of L-VS guests.

eth0 - this net-device has a cable on it with the sub-net 192.168.0.0/24
running on it (and a couple others, for other purposes).
My Host context has an address in this sub-net (192.168.0.66)

dummy0 - this net-device does not have a cable (or card) on it, but
does have the sub-net 192.168.4.0/24 running on it.
Each of my Guest contexts have a (single) address in this sub-net.

Obviously, anything addressed to 192.168.4.x is going to go into the
bit bucket without some sort of help along the way.
Also, nothing will be coming out of that bit bucket without a little
help along the way.  Giving you complete control of 'incoming' packets.

The single iptables rule that networks the two sub-nets by address
translation (rather than bridging or something els):
iptables -t nat -I POSTROUTING -s 192.168.4.0/24 ! -d 192.168.4.0/24 -j SNAT --to 192.168.0.66

At which point I stopped - The above seems to do what I need and
I have another local rule: KISS

Note: You are not locked into your network plan for guests at build
time - -
Browse: /etc/vservers/<vserver-name>/* to find network configuration.

** But your question - which is best?  I don't have a clue.

Mike
> I want to do something which is probably very typical of virtual 
> servers. I believe there are at least two techniques to do it (see 
> below), but because I have not done it before I am not sure which 
> technique is best or if both techniques are possible. I hope some of you 
> can share your recommendations and why :
> 
> I wish to set up a virtual server host with several guests. Each guest 
> is to run a network service and I am intending on using the host's 
> iptables to limit access to and in between the host and the guests and 
> the other systems in the network. The network is a private subnet and 
> there is no shortage of available ip addresses. The host has only one 
> NIC (eth0). The only reason for running the network services in separate 
> guests rather than running them all in the host, is for security. The 
> network services are to include; apache2 web server, exim4 email, 
> apt-cacher, bit torrent, scalix email.
> 
> Initially I assumed the technique of building/configuring each guest to 
> use the host's eth0 interface with their own unique ip address in the 
> host's eth0 subnet.
> 
> Then having browsed the virtual-server.org site I found an alternative 
> technique of creating the dummy0 interface in the host with a ip address 
> in a subnet different to eth0's subnet, and then building/configuring 
> each guest to use the dummy0 interface with their own unique ip address 
> in the host's dummy0 subnet. And then allowing other systems in the 
> network to access the network services either by using the host as a 
> simple router or by setting up port/service forwarding from host to 
> relevant guest.
> 
> Are there any particular reasons why I should use the dummy0 technique 
> rather than the simpler eth0 technique ?
> 
> BTW, I'm using the current Debian Lenny distribution and its virtual 
> server kernel image (version "2.6.26+17") with its virtual server 
> version "2.3" and the "util-vserver" version is "0.30.216~r2772-4". The 
> "uname -a" output is "Linux max 2.6.26-1-vserver-686 #1 SMP Mon Dec 15 
> 21:11:05 UTC 2008 i686 GNU/Linux".
> 
> Thanks,
> Declan
> 
> 
> 
> 
> 
> 
>