Am Mittwoch, den 08.08.2007, 10:30 +0200 schrieb Baltasar Cevc: > Thomas, > > On Wed, 08 Aug 2007 03:25:29 +0200 > Thomas Weber <l_vserver@mail2news.4t2.com> wrote: > > > Am Mittwoch, den 08.08.2007, 01:48 +0200 schrieb Herbert Poetzl: > You could just leave out the interface and everything would be more or > less the same for filtering (INPUT for both ethX and lo). For NAT and [... i'm aware how to set up firewalling rules on the host ...] > iptables -A INPUT -i lo -d <vserver-net> -j VSERVERS > [rules inserted by script into VSERVERS follow] > > We have some more checks, but in principle, it looks like that. > > With this design, you can just filter for subnets in the VSERVERS > chain and ignore the incoming interface. I dont want this approach for the same reason that companies setup central firewalls instead of managing firewalling on every single host. (Of course it's always a good idea to secure the hosts themself, but not doing so shouldn't rip holes into the setup of the whole network). > > > you just make the firewall rules for ethX _and_ lo > > > and you are perfectly fine, wherever the guest is > > > > 3 hosts, 2 production, one for development/testing, later maybe more. > > I'd have to manage firewalling rules on the GW and on 3 hosts. The one > > responsible for the GW is not the one responsible for the vserver > > hosts. Managing 3 different systems (GW, production,development) with > > their own firewalling semantics for the same rules on 4+ boxes is > > asking for trouble. > > Don't you think that'd be bad design? > Depends on how you implement it, I'd say. Yeah, thats like dropping DNS and using /etc/hosts instead. I'm sure it works if you implement it right. > > > > IDS would be another issue. > > > > > > assuming that IDS stands for Intrusion-Detection System > > > what problem do you see with that? > > > > IDS setup on the GW won't see all vserver-vserver traffic. > > Same with accounting etc. > > In case of an incident when one of the production machines goes down > > and the other hosts all vservers, accounting would show less traffic > > and the IDS wouldn't see anything at all. > I see your point with accounting; just one thing to say anyway: traffic > on lo is _really_ inexpensive anytime, so I probably wouldn't mind > trying to account that. This is not about cost. This is about trends in traffic, about spikes, about accounting different protocols and future planing of the network infrastructure. > But about the traffic hitting the wire: IP is routed stuff. Wouldn't > the packets have to have the ARP destination of the localhost, thus not > even hitting the wire when they were sent to the ethernet card? As I said in my initial post, the vservers i'm talking about are on different subnets and different NICs (same host though). Tom