Subject: Re: [vserver] Routing problem in Debian
From: Olivier BATARD <obatard@gmail.com>
Date: Thu, 14 Jan 2010 21:19:26 +0100

 Thu, 14 Jan 2010 21:19:26 +0100
Hi,


Thanks again but I have a problem :


I've made two table :


- rt1 : One route 192.168.2.0/ 24 dev eth1
- rt2 : One route 192.168.3.0/34 dev eth0

The rules has been made too :


0:      from all lookup local
32764:  from 192.168.3.0/24 lookup rt2
32765:  from 192.168.2.0/24 lookup rt1


The main table is empty.

Works greats, guests are isolated but when I want to add default route with :

ip route add default via 192.168.2.1 table rt1 or   ip route add 192.168.3.0/24 via
192.168.2.1 table rt1 

I've the error :

RTNETLINK answers: No such process

Thanks for your help

Le 12 janv. 2010 à 23:56, Laurent Spagnol a écrit :

> Hi,
> 
> Message de Olivier BATARD <obatard@gmail.com>:
> 
>> Hello,
>> 
>> We're trying to build a vserver infrastructure on Debian Lenny with
>> following parameter :
>> 
>> OS :
>> 
>> - One host with the kernel 2.6.26 / Debian lenny
> The usage of the Lenny Kernel is not a good idea.
> 
> with the debian tools
>> - 3 guests, each one runs on a logical volume in reiserfs
>> 
>> Network :
>> 
>> - 2 Vlan, one for the the lan, one for the dmz
>> - some guests's ip are one the dmz, some on the lan
>> - on the hosts we have an /etc/interface with two interfaces with bonding
>> (balance-rr mode)
>> - Vlan have been set up in the network configuration, each guest interfaces
>> as bond0.vlan as device.
>> 
>> 
>> Here's my problem,
>> 
>> On a dmz guest, when I run a ip route show, I see the routes of the host, so
>> a route to the lan ...
> Linux-Vserver doesn't virtualize the network layer, so all the routes are seen by
all the guests.
> 
> which is not good for security ...
> I think it's not really a problem. You can use iptables on the host side for isolating
your networks.
> 
>> 
>> What is the best solution to isolate the guest and controlling routing ? . I
>> googled it and I found some answers by using ip route with alternate
>> table ...
> Sure. I use 802.1Q VLANs and alternate routing tables.
> 
> Is it the best and easiest solution now ?
> In my opinion, it is the most simplest and cleanest way to do that.
> 
> How can I set up that
>> correctly in Debian ?
> The solution is not specific to Debian.
> 
> An example:
> vconfig add eth0 7
> ip rule add from 10.7.0.0/16 table 7
> ip route add 10.7.0.0/16 dev eth0.7 table 7
> ip route add default via 10.7.0.1   table 7
> echo eth0.7      > /etc/vservers/vs 7/interfaces/0/dev
> echo 10.0.7.0.2  > /etc/vservers/vs 7/interfaces/0/ip
> 
> Google => "presentation-vserver.odp" for the full example.
> 
> But the author has forgotten two details:
> - a routing table can be enabled only when at less one IP is available on the matching
network
> - you must force "automatic promotion of secondary addresses to primary"
> echo "net.ipv4.conf.all.promote secondaries=1">>/etc/sysctl.conf
> 
> In fact, i wrote a script that handle routes during the start sequence of the Vservers.
> 
> An example is available here:
> http://dokuwicri.univ-reims.fr/files/vs-tools2/vs-tools/scripts/
> 
> You can get some ideas here for firewalling:
> http://dokuwicri.univ-reims.fr/wiki/doku.php?id=public:projets:vs-tools:configuration
du firewall
> My old ugly scripts are available here:
> https://listes.univ-reims.fr/sympa/d read/vs-tools/Sources/
> (http://dokuwicri.univ-reims.fr/wiki/doku.php?id=public:projets:vs-tools:start)
> 
> Regards,
> 
> L.S.
> 
> 
> 
> 
>> 
>> Thanks by advance ...
>> 
> 
> 
> 
> -- 
> Laurent Spagnol
> Administrateur système Linux
> 
> CRI - Université de Reims
> 
> Campus du Moulin de la Housse
> BP 1039 - 51687 Reims cedex 2
> 
> Tel: 03.26.91.88.32
> Fax: 03.26.91.31.87
> 
> 
>