Subject: Re: [vserver] change net.ipv4.ip_local_port_range for specific guest
From: Art -kwaak- van Breemen <ard@telegraafnet.nl>
Date: Wed, 12 Dec 2012 13:25:09 +0100

On Wed, Dec 12, 2012 at 12:53:02PM +0100, Herbert Poetzl wrote:
> > How can I change net.ipv4.ip_local_port_range only for specific guest?
> 
> maybe by utilizing a network namespace, but no guarantees there

I know that at least tcp_keepalive_time is global.
harry:/proc/sys/net/ipv4# echo 32767 61000 > ip_local_port_range 
harry:/proc/sys/net/ipv4# cat ip_local_port_range 
32767   61000
harry:/proc/sys/net/ipv4# vspace -e v1012 --net cat ip_local_port_range 
32767   61000

so local-port-range is global too.
Iptables is per network namespace though...
(The modules are global, so keep an eye on your conntrack per
network namespace, it might be way too low).

Anyway: to answer the question in another way:
You should always expand the ip_local_port_range, since the
local_port_range is actually shared.
You will not have enough local ports if you are going to connect
to a vserver on the same hosts. It seems that if the traffic is
host local, linux will prevent using same source ports, even if
the local source address is different. (In tcp the
sourceip:sourceport destinationip:destinationport should be
unique. It seems like if you do local traffic, it's more like
sourceport destinationport that must be unique, at least for
time_wait).
This matters if you have haproxy and varnish on the same host
connecting to eachother. Of course when having seperate network
namespaces (which means seperate ip stacks) it doesn't matter.