Subject: Re: [vserver] Re: New guy needs a little help
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 10 Sep 2008 10:47:18 +0200

On Tue, Sep 09, 2008 at 08:41:20PM -0600, Caleb Call wrote:
> I have already tried copying over my /etc/resolv.conf from teh host
> with no luck. Also what's in my /etc/resolv.conf on the guest is
> identical to my host.
> 
> I have changed the /etc/ssh/sshd_config to only listen to one of my
> IPs (I have two static IPs on this box). I also do not have any DNS
> services running on the host. It's a co-located server that is used
> strictly for web hosting.

> The method I used (exact command) is: vserver default build
> -m yum --context 42 --hostname default.oxygen --interface
> eth0:192.168.1.11/24 -- -d centos5

this will use the private ip 192.168.1.11 in 192.168.1.0/24
for the guest, is that network routed/NAT-ed to reach
the internet?

> I wanted the guest named default, I plan for it to be my "base"
> for all my other guests. I also tried using a template method
> using a template from sandino. The command I used to build
> that one was: server tmachine build -m template --hostname
> tmachine --interface eth0:10.0.200.2/24 -- -d centos5 -t
> /vservers/.templates/centos-5-i686-2008-07-07.tar.bz2. It built
> correctly as well but I ended up with the exact same results.

this uses another private ip 10.0.200.2 in 10.0.200.0/24
for the guest, again, if that address is not able to
reach the internet (via routing and NAT-ing) then you
are out of luck

> *ip addr ls output from*
> *host - *
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>     inet 127.0.0.1/8 scope host lo
>     inet6 ::1/128 scope host
>        valid_lft forever preferred_lft forever
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen
> 1000
>     link/ether 00:14:d1:10:0d:c4 brd ff:ff:ff:ff:ff:ff
>     inet 209.17.191.189/23 brd 209.17.191.255 scope global eth0
>     inet 209.17.191.190/30 brd 209.17.191.191 scope global eth0
>     inet 192.168.1.11/24 brd 192.168.1.255 scope global eth0
>     inet 209.17.191.190/23 brd 209.17.191.255 scope global secondary eth0:1
>     inet6 fe80::214:d1ff:fe10:dc4/64 scope link
>        valid_lft forever preferred_lft forever

this looks like the host is a little confused (read
misconfigured), or why would you have the same address
209.17.191.190 in two different networks /23 and /30?

it also suggests that the host uses public IPs, and
natually either the guest will require a public IP too
or the host has to do some S/DNAT to allow the private
IPs you assigned to guests to reach the internet

http://linux-vserver.org/Frequently_Asked_Questions#If_my_host_has_only_one_a_single_public_IP.2C_can_I_use_RFC1918_IP_.28e.g._192.168.foo.bar.29_for_the_guest_vservers.3F

best,
Herbert

> *guest - *
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>     inet 127.0.0.1/8 scope host lo
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen
> 1000
>     link/ether 00:14:d1:10:0d:c4 brd ff:ff:ff:ff:ff:ff
>     inet 192.168.1.11/24 brd 192.168.1.255 scope global eth0
> 
> *output of vserver-info:*
> ersions:
>                    Kernel: 2.6.22.19-vs2.3.0.34.1
>                    VS-API: 0x00020302
>              util-vserver: 0.30.216-pre2772; Aug 25 2008, 01:17:19
> 
> Features:
>                CC: gcc, gcc (GCC) 4.1.2 20071124 (Red Hat 4.1.2-42)
>                       CXX: g++, g++ (GCC) 4.1.2 20071124 (Red Hat 4.1.2-42)
>                  CPPFLAGS: ''
>                    CFLAGS: '-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2
> -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
> -std=c99 -Wall -pedantic -W -funit-at-a-time'
>                  CXXFLAGS: '-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2
> -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
> -ansi -Wall -pedantic -W -fmessage-length=0 -funit-at-a-time'
>                build/host: x86_64-redhat-linux-gnu/x86_64-redhat-linux-gnu
>              Use dietlibc: yes
>        Build C++ programs: yes
>        Build C99 programs: yes
>            Available APIs: v13,net,v21,v22,v23,netv2
>             ext2fs Source: e2fsprogs
>     syscall(2) invocation: alternative
>       vserver(2) syscall#: 236/glibc
>                crypto api: beecrypt
> 
> Paths:
>                    prefix: /usr
>         sysconf-Directory: /etc
>             cfg-Directory: /etc/vservers
>          initrd-Directory: /etc/rc.d/init.d
>        pkgstate-Directory: /var/run/vservers
>           vserver-Rootdir: /vservers
> 
> 
> Assumed 'SYSINFO' as no other option given; try '--help' for more
> information.
> 
> 
> *I appreciate the quick responses guys.  Thanks for any help.*
> 
> 
> On Tue, Sep 9, 2008 at 7:55 PM, Jason Drage <jasond@ibsglobalweb.com> wrote:
> 
> >
> > Hi Caleb,
> > I don't know if this is a helpful clue, but if you run any service on
> > the host that defaults to listening to all addresses (a common example
> > is ssh), this will prevent the correct operation of such a service in
> > the guest.
> > For example if you happen to have a caching-only dns server running on
> > your host it might be interfering with lookups from the guest. Solution
> > in this case is to configure these services on the host to listen on
> > specified ip addresses only.
> >
> > You shouldn't need to explicitly set a default route.
> >
> > What method did you use to create the guest (the exact command line you
> > used can help)?
> >
> > Send the output of 'ip addr ls' from both the host and guest if you can.
> >
> > Other useful debug info is the output of 'vserver-info'
> >
> >
> > cheers,
> > Jason
> >
> >
> >