Subject: Re: [vserver] VServer with Host as Gateway
From: "Stuart Lester" <stuart.lester@gmail.com>
Date: Wed, 24 Oct 2007 15:59:05 -0400

Well, I've figured out _a_ solution, though it may not be _the_ solution:
  The virtual guest has two NICs, eth0 and eth1.  Traffic for the WAN
goes out on eth0, Traffic for the LAN goes out on eth1.  Just like
with the virtual host.  I had hoped to not do this, as it doesn't feel
as "clean" as a single NIC for the virtual guest, but in some ways it
is infinitely simpler than all the various routing schemes I've tried.

Daniel...can you explain your statement below about getting stuck in a
loop?  Traffic for me seems to be fine.

My current configs are as follows (I can send the iptables commands if
that is easier to read...none of it is particularly easy for me to
decipher):
  HOST ~ # iptables -L
  Chain INPUT (policy ACCEPT)
  target     prot opt source               destination

  Chain FORWARD (policy DROP)
  target     prot opt source               destination
  ACCEPT     all  --  10.50.50.0/24        anywhere
  ACCEPT     all  --  anywhere             10.50.50.0/24

  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination

  HOST ~ # iptables -t nat -L
  Chain PREROUTING (policy ACCEPT)
  target     prot opt source               destination
  DNAT       tcp  --  anywhere             anywhere            tcp
dpt:ssh to:10.50.50.1:22

  Chain POSTROUTING (policy ACCEPT)
  target     prot opt source               destination
  SNAT       all  --  anywhere             anywhere
to:192.168.100.254

  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination

And for completeness, my /etc/conf.d/net looks like:
  config_eth0=(
          "192.168.100.253/24"
          "192.168.100.254/24")
  routes_eth0=( "default via 192.168.100.1" )

  config_eth1=(
          "10.50.50.1/24"
          "10.50.50.10/24"
  )

Is there anything that you guys see in this that makes it a bad idea?
The biggest flaw I see right now is that if/when I remove that linksys
router from between this machine an the cable modem, I won't have the
luxury of multiple IPs on eth0.

Stu

On 10/24/07, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
> Stuart Lester wrote:
> > Ladies and Gentlemen,
> ...
>
> I assume this is not the config that kind of works, since you're missing
> a ) on the last line, and any traffic would get stuck in a loop. For the
> kind of setup you're interested in, you really shouldn't need to do
> anything special with regard to the routing, so just removing those
> routes and rules should make everything behave...
>
> --
> Daniel Hokka Zakrisson
>