Subject: Re: [vserver] Networking questions
From: Mark Little <marklittle@koallo.com>
Date: Tue, 22 Jun 2010 21:27:27 -0400

  On 22/06/2010 7:27 PM, Herbert Poetzl wrote:
> On Mon, Jun 21, 2010 at 10:35:36PM -0700, Siv wrote:
>> My requirement is to allow different routing table for the
>> guest and host.
>> Is that possible?
> yes, if you want performance, use multiple routing tables
> and select them based on the source IP, if you don't care
> about performance, check out the network namespaces, they
> will allow you to have 'virtual' network spaces
>
>> Please let me know,
> best,
> Herbert

Hi Herbert,

On a related note - I was wondering if you could let me know if what I 
am seeing is normal or I have broken my vserver config somehow..

Kernel: 2.6.31.13-vs2.3.0.36.28.2-beng
VS-API: 0x00020305
util-vserver: 0.30.216-pre2883; Apr 28 2010, 15:36:17

I currently utilize source routing using the iproute2 system, however I 
was wondering if its normal for the guests to be able able to see all 
the rules and routes even if they do not apply to them.

'ip addr ls' only shows the assigned interfaces, however 'ip route ls' 
shows extra routes which give away the source IP.

eg:

[gizmo1:~]# ip addr ls
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
     inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast 
state UP qlen 1000
     link/ether 00:0d:60:9c:37:82 brd ff:ff:ff:ff:ff:ff
     inet 10.1.1.20/24 brd 10.1.1.255 scope global secondary eth0
     inet xxx.xxx.194.119/27 brd xxx.xxx.194.127 scope global secondary eth0

[gizmo1:~]# ip route ls
xxx.xxx.194.96/27 dev eth0  proto kernel  scope link  src xxx.xxx.194.113
xxx.xxx.201.128/25 dev eth0  proto kernel  scope link  src xxx.xxx.201.162
xxx.xxx.219.0/24 dev eth0  proto kernel  scope link  src xxx.xxx.219.34
xxx.xxx.194.0/24 dev eth0  proto kernel  scope link  src xxx.xxx.194.118
10.1.1.0/24 dev eth0  proto kernel  scope link  src 10.1.1.36
default via xxx.xxx.194.97 dev eth0  src xxx.xxx.194.113

[gizmo1:~]# ip rule ls
0:      from all lookup local
9999:   from 10.1.1.0/24 to xxx.xxx.194.0/24 lookup 203
20000:  from xxx.xxx.194.118 lookup 204
20000:  from xxx.xxx.194.119 lookup 205
20000:  from xxx.xxx.194.125 lookup 210
20000:  from xxx.xxx.201.162 lookup 210
20000:  from xxx.xxx.219.34 lookup 210
20000:  from xxx.xxx.219.202 lookup 210
32766:  from all lookup main
32767:  from all lookup default
[root@gizmo1:~]#

It's not a huge issue for us at the moment as most of the our vserver 
guests are internal servers - however we were looking at offering it as 
a service, which means now I have to worry more about security.

I will look into the network namespaces as that may be the safest option 
for those specific servers, but I just wanted to make sure I haven't 
done something wrong along the way which is allowing this information to 
be shown.


Regards,
Mark