On Thu, Sep 02, 2010 at 02:55:35PM +0200, Marcus Mülbüsch wrote: > Hello all, > I have a server with two NICs. I'd like to have the host use one of > the NICs (with a 192.168.1.x-address), while the Guest uses the other > NIC only (with a 192.168.2.x). > This sort of puts the guest into the DMZ, while I can reach the host > in the internal net, and then enter the guest. > While that it is not as good as putting the whole machine into the > DMZ it saves on hardware and keeps the infrastructure small. > First, is there anything basically wrong with that reasoning? It may > be easier to break out from a VServer guest into the host as breaking > through another firewall, but not by much. > Second, and here is where my problem starts: > - The second NIC (eth1) is not assigned an IP address on the host. so you are using network namespaces then? because Linux-VServer by default uses network isolation, in which case the host always has _all_ the IPs assigned (those host only as well as all guest IPs) > - The VServer is assigned eth1 as its one and only NIC. > /etc/vservers/myserver/interfaces/0/dev ./ip and ./prefix are set to > "eth1", "192.168.3.x", and "24" respectively. that doesn't mean that you 'assign' eth1 to anything, on the contrary, it only means that the IP (192.168.3.x) will be _assigned_ to eth1, when the guest is started (and removed from eth1 on guest shutdown) > - Now, when the VServer is started, something "interesting" happens - > Even though eth0 is not activated, it shows up with "ip route show", > though as "if1" that is fine, as a route exists to the interface which is relevant for that guest > 192.168.3.0/24 dev eth1 proto kernel scope link src 192.168.3.x > 192.168.1.0/24 dev if1 proto kernel scope link src 192.168.1.x > 127.0.0.0/8 dev if3 scope link > default via 192.168.1.x dev if1 > Especially annoying is the fact that the default gateway is the one > of the Vserver Host. No wonder it doesn't work. again, for network isolation that is expected, you'll need to setup multiple routing tables to have a different default gateway for the guest IPs ... > I could change the routing on the host, using "ip route del" and "ip > route add". However that would mean to give the guest "NET_ADMIN" > capability; which means it is a very bad idea. in what way would that help and why does the guest need NET_ADMIN if you change something on the host? > I feel I'm missing something very basic about either VServers or > Advanced Routing :) probably, my guess would be network isolation vs network context (and thus virtual network stack as used in qemu or similar) > What am I doing wrong? > I'm using Versions: > Kernel: 2.6.22-vs2.2.0.7-gentoo > VS-API: 0x00020200 > util-vserver: 0.30.215; Jan 13 2010, 12:12:31 quite old kernel, ancient tools, so all you have here is IP isolation (network contexts require quite recent kernels, patches and util-vserver to get them working) HTH, Herbert > Thanks for any help or pointers, > Marcus