Hi, On Thu, Apr 18, 2013 at 12:15:35PM +0200, Laurens Vets wrote: > I was wondering what the best way is to configure a private network > between guests. Would it be best to use a dummy device on the host > or just an alias on the loopback interface in the guests? I think the dummy device should be banned. Nobody seems to really understand it. if !( use network namespace) { There is a single IP stack. Every ip on every interface, it doesn't matter. One stack! Communications between those ip's are *always* local. An ip with a mask on an interface is only put there for routing and arp purposes. There are 2 exceptions to this rule: 1a) 127.0.0.0/8 has a special filtering in vanilla linux that can be turned off. If turned off, you can use 127.0.0.0/8 on every interface as normal routable ip addresses. 1b) 127.0.0.0/8 has a special filtering in vserver linux with a network context (That's about 99.999999999% of those that read this). If I am correct, under water it will be rewritten to 127.<networkcontextid>.1, which means the localhost of that vserver. 2) network masks used on lo means you bind to *all* addresses in that network. 127.0.0.0/8 means you can use 127.0.0.0 to 127.255.255.255 . 192.168.1.15/24 on lo means that you own every ip address from 192.168.1.0 to 192.168.1.255 . That's an easy way to kill a network, because you will have all those addresses, and hence will respond to arp requests for all those addresses. IPv6 is almost the same, except for arp (neighbour discovery). Because the neigbour discovery in IPv6 works differently, you can not put an ipv6 address on lo, and expect everything to work. Your host will not respond to discovery. For that you need to add a ipv6 proxy entry for that address on the correct interface. Or you just add that ip address to that interface with the right mask. } If you use network namespaces, all this applies *per* namespace. Each namespace is a seperate ip stack following the same rules. Hmmm: http://www.paul.sladen.org/vserver/archives/201009/0109.html Same answer: you don't need another interface. But remember: that "network" will not be private. It will be accessible by any interface on the server.