Subject: Re: [vserver] Re: New guy needs a little help
From: "Caleb Call" <caleb@macjunk.net>
Date: Wed, 10 Sep 2008 08:37:16 -0600
Wed, 10 Sep 2008 08:37:16 -0600
Thanks, those were the same things I was thinking, why is the same IP setup
on two interfaces with two different subnets and a private IP shouldn't be
routable to unless I do some NATing.  I just couldn;t find anything pointing
me in the right direction.  I think those links you sent will do what I'm
looking for.

On Wed, Sep 10, 2008 at 2:47 AM, Herbert Poetzl <herbert@13thfloor.at>wrote:

> On Tue, Sep 09, 2008 at 08:41:20PM -0600, Caleb Call wrote:
> > I have already tried copying over my /etc/resolv.conf from teh host
> > with no luck. Also what's in my /etc/resolv.conf on the guest is
> > identical to my host.
> >
> > I have changed the /etc/ssh/sshd_config to only listen to one of my
> > IPs (I have two static IPs on this box). I also do not have any DNS
> > services running on the host. It's a co-located server that is used
> > strictly for web hosting.
>
> > The method I used (exact command) is: vserver default build
> > -m yum --context 42 --hostname default.oxygen --interface
> > eth0:192.168.1.11/24 -- -d centos5
>
> this will use the private ip 192.168.1.11 in 192.168.1.0/24
> for the guest, is that network routed/NAT-ed to reach
> the internet?
>
> > I wanted the guest named default, I plan for it to be my "base"
> > for all my other guests. I also tried using a template method
> > using a template from sandino. The command I used to build
> > that one was: server tmachine build -m template --hostname
> > tmachine --interface eth0:10.0.200.2/24 -- -d centos5 -t
> > /vservers/.templates/centos-5-i686-2008-07-07.tar.bz2. It built
> > correctly as well but I ended up with the exact same results.
>
> this uses another private ip 10.0.200.2 in 10.0.200.0/24
> for the guest, again, if that address is not able to
> reach the internet (via routing and NAT-ing) then you
> are out of luck
>
> > *ip addr ls output from*
> > *host - *
> > 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
> >     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> >     inet 127.0.0.1/8 scope host lo
> >     inet6 ::1/128 scope host
> >        valid_lft forever preferred_lft forever
> > 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen
> > 1000
> >     link/ether 00:14:d1:10:0d:c4 brd ff:ff:ff:ff:ff:ff
> >     inet 209.17.191.189/23 brd 209.17.191.255 scope global eth0
> >     inet 209.17.191.190/30 brd 209.17.191.191 scope global eth0
> >     inet 192.168.1.11/24 brd 192.168.1.255 scope global eth0
> >     inet 209.17.191.190/23 brd 209.17.191.255 scope global secondary
> eth0:1
> >     inet6 fe80::214:d1ff:fe10:dc4/64 scope link
> >        valid_lft forever preferred_lft forever
>
> this looks like the host is a little confused (read
> misconfigured), or why would you have the same address
> 209.17.191.190 in two different networks /23 and /30?
>
> it also suggests that the host uses public IPs, and
> natually either the guest will require a public IP too
> or the host has to do some S/DNAT to allow the private
> IPs you assigned to guests to reach the internet
>
>
> http://linux-vserver.org/Frequently_Asked_Questions#If_my_host_has_only_one_a_single_public_IP.2C_can_I_use_RFC1918_IP_.28e.g._192.168.foo.bar.29_for_the_guest_vservers.3F
>
> best,
> Herbert
>
> > *guest - *
> > 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
> >     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> >     inet 127.0.0.1/8 scope host lo
> > 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen
> > 1000
> >     link/ether 00:14:d1:10:0d:c4 brd ff:ff:ff:ff:ff:ff
> >     inet 192.168.1.11/24 brd 192.168.1.255 scope global eth0
> >
> > *output of vserver-info:*
> > ersions:
> >                    Kernel: 2.6.22.19-vs2.3.0.34.1
> >                    VS-API: 0x00020302
> >              util-vserver: 0.30.216-pre2772; Aug 25 2008, 01:17:19
> >
> > Features:
> >                CC: gcc, gcc (GCC) 4.1.2 20071124 (Red Hat 4.1.2-42)
> >                       CXX: g++, g++ (GCC) 4.1.2 20071124 (Red Hat
> 4.1.2-42)
> >                  CPPFLAGS: ''
> >                    CFLAGS: '-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2
> > -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64
> -mtune=generic
> > -std=c99 -Wall -pedantic -W -funit-at-a-time'
> >                  CXXFLAGS: '-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2
> > -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64
> -mtune=generic
> > -ansi -Wall -pedantic -W -fmessage-length=0 -funit-at-a-time'
> >                build/host:
> x86_64-redhat-linux-gnu/x86_64-redhat-linux-gnu
> >              Use dietlibc: yes
> >        Build C++ programs: yes
> >        Build C99 programs: yes
> >            Available APIs: v13,net,v21,v22,v23,netv2
> >             ext2fs Source: e2fsprogs
> >     syscall(2) invocation: alternative
> >       vserver(2) syscall#: 236/glibc
> >                crypto api: beecrypt
> >
> > Paths:
> >                    prefix: /usr
> >         sysconf-Directory: /etc
> >             cfg-Directory: /etc/vservers
> >          initrd-Directory: /etc/rc.d/init.d
> >        pkgstate-Directory: /var/run/vservers
> >           vserver-Rootdir: /vservers
> >
> >
> > Assumed 'SYSINFO' as no other option given; try '--help' for more
> > information.
> >
> >
> > *I appreciate the quick responses guys.  Thanks for any help.*
> >
> >
> > On Tue, Sep 9, 2008 at 7:55 PM, Jason Drage <jasond@ibsglobalweb.com>
> wrote:
> >
> > >
> > > Hi Caleb,
> > > I don't know if this is a helpful clue, but if you run any service on
> > > the host that defaults to listening to all addresses (a common example
> > > is ssh), this will prevent the correct operation of such a service in
> > > the guest.
> > > For example if you happen to have a caching-only dns server running on
> > > your host it might be interfering with lookups from the guest. Solution
> > > in this case is to configure these services on the host to listen on
> > > specified ip addresses only.
> > >
> > > You shouldn't need to explicitly set a default route.
> > >
> > > What method did you use to create the guest (the exact command line you
> > > used can help)?
> > >
> > > Send the output of 'ip addr ls' from both the host and guest if you
> can.
> > >
> > > Other useful debug info is the output of 'vserver-info'
> > >
> > >
> > > cheers,
> > > Jason
> > >
> > >
> > >
>


Thanks, those were the same things I was thinking, why is the same IP setup on two interfaces with two different subnets and a private IP shouldn't be routable to unless I do some NATing.  I just couldn;t find anything pointing me in the right direction.  I think those links you sent will do what I'm looking for.

On Wed, Sep 10, 2008 at 2:47 AM, Herbert Poetzl <herbert@13thfloor.at> wrote:
On Tue, Sep 09, 2008 at 08:41:20PM -0600, Caleb Call wrote:
> I have already tried copying over my /etc/resolv.conf from teh host
> with no luck. Also what's in my /etc/resolv.conf on the guest is
> identical to my host.
>
> I have changed the /etc/ssh/sshd_config to only listen to one of my
> IPs (I have two static IPs on this box). I also do not have any DNS
> services running on the host. It's a co-located server that is used
> strictly for web hosting.

> The method I used (exact command) is: vserver default build
> -m yum --context 42 --hostname default.oxygen --interface
> eth0:192.168.1.11/24 -- -d centos5

this will use the private ip 192.168.1.11 in 192.168.1.0/24
for the guest, is that network routed/NAT-ed to reach
the internet?

> I wanted the guest named default, I plan for it to be my "base"
> for all my other guests. I also tried using a template method
> using a template from sandino. The command I used to build
> that one was: server tmachine build -m template --hostname
> tmachine --interface eth0:10.0.200.2/24 -- -d centos5 -t
> /vservers/.templates/centos-5-i686-2008-07-07.tar.bz2. It built
> correctly as well but I ended up with the exact same results.

this uses another private ip 10.0.200.2 in 10.0.200.0/24
for the guest, again, if that address is not able to
reach the internet (via routing and NAT-ing) then you
are out of luck

> *ip addr ls output from*
> *host - *
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>     inet 127.0.0.1/8 scope host lo
>     inet6 ::1/128 scope host
>        valid_lft forever preferred_lft forever
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen
> 1000
>     link/ether 00:14:d1:10:0d:c4 brd ff:ff:ff:ff:ff:ff
>     inet 209.17.191.189/23 brd 209.17.191.255 scope global eth0
>     inet 209.17.191.190/30 brd 209.17.191.191 scope global eth0
>     inet 192.168.1.11/24 brd 192.168.1.255 scope global eth0
>     inet 209.17.191.190/23 brd 209.17.191.255 scope global secondary eth0:1
>     inet6 fe80::214:d1ff:fe10:dc4/64 scope link
>        valid_lft forever preferred_lft forever

this looks like the host is a little confused (read
misconfigured), or why would you have the same address
209.17.191.190 in two different networks /23 and /30?

it also suggests that the host uses public IPs, and
natually either the guest will require a public IP too
or the host has to do some S/DNAT to allow the private
IPs you assigned to guests to reach the internet

http://linux-vserver.org/Frequently_Asked_Questions#If_my_host_has_only_one_a_single_public_IP.2C_can_I_use_RFC1918_IP_.28e.g._192.168.foo.bar.29_for_the_guest_vservers.3F

best,
Herbert

> *guest - *
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>     inet 127.0.0.1/8 scope host lo
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen
> 1000
>     link/ether 00:14:d1:10:0d:c4 brd ff:ff:ff:ff:ff:ff
>     inet 192.168.1.11/24 brd 192.168.1.255 scope global eth0
>
> *output of vserver-info:*
> ersions:
>                    Kernel: 2.6.22.19-vs2.3.0.34.1
>                    VS-API: 0x00020302
>              util-vserver: 0.30.216-pre2772; Aug 25 2008, 01:17:19
>
> Features:
>                CC: gcc, gcc (GCC) 4.1.2 20071124 (Red Hat 4.1.2-42)
>                       CXX: g++, g++ (GCC) 4.1.2 20071124 (Red Hat 4.1.2-42)
>                  CPPFLAGS: ''
>                    CFLAGS: '-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2
> -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
> -std=c99 -Wall -pedantic -W -funit-at-a-time'
>                  CXXFLAGS: '-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2
> -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic
> -ansi -Wall -pedantic -W -fmessage-length=0 -funit-at-a-time'
>                build/host: x86_64-redhat-linux-gnu/x86_64-redhat-linux-gnu
>              Use dietlibc: yes
>        Build C++ programs: yes
>        Build C99 programs: yes
>            Available APIs: v13,net,v21,v22,v23,netv2
>             ext2fs Source: e2fsprogs
>     syscall(2) invocation: alternative
>       vserver(2) syscall#: 236/glibc
>                crypto api: beecrypt
>
> Paths:
>                    prefix: /usr
>         sysconf-Directory: /etc
>             cfg-Directory: /etc/vservers
>          initrd-Directory: /etc/rc.d/init.d
>        pkgstate-Directory: /var/run/vservers
>           vserver-Rootdir: /vservers
>
>
> Assumed 'SYSINFO' as no other option given; try '--help' for more
> information.
>
>
> *I appreciate the quick responses guys.  Thanks for any help.*
>
>
> On Tue, Sep 9, 2008 at 7:55 PM, Jason Drage <jasond@ibsglobalweb.com> wrote:
>
> >
> > Hi Caleb,
> > I don't know if this is a helpful clue, but if you run any service on
> > the host that defaults to listening to all addresses (a common example
> > is ssh), this will prevent the correct operation of such a service in
> > the guest.
> > For example if you happen to have a caching-only dns server running on
> > your host it might be interfering with lookups from the guest. Solution
> > in this case is to configure these services on the host to listen on
> > specified ip addresses only.
> >
> > You shouldn't need to explicitly set a default route.
> >
> > What method did you use to create the guest (the exact command line you
> > used can help)?
> >
> > Send the output of 'ip addr ls' from both the host and guest if you can.
> >
> > Other useful debug info is the output of 'vserver-info'
> >
> >
> > cheers,
> > Jason
> >
> >
> >