Subject: Re: [vserver] Routing of vserver guests on multihomed hosts
From: Oliver Welter <mail@oliwel.de>
Date: Sat, 13 Sep 2008 13:40:01 +0200

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Daniel

Daniel Hokka Zakrisson schrieb:
> Oliver Welter wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hi All,
>>
>> I am looking for help to setup my routing ;(
>>
>> Host:
>> Homed in two different vlans
>>
>> vlan3@eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue
>>     inet 82.135.58.9/25 brd 82.135.58.127 scope global vlan3
>> vlan4@eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue
>>     inet 212.18.24.209/26 brd 212.18.24.255 scope global vlan4
>>
>> Guest, having an interface only in vlan4
>>
>> I tried different routing setups:
>> hosts default route via vlan4 -> works
>>
>> hosts default route via vlan3 -> I see in the guest:
>> 0.0.0.0 82.135.58.1 0.0.0.0 UG 0 0 0 *
>> As the guest does not know about vlan3, I cant ping to networks other
>> than those connected to vlan4
> 
> The guest not knowing about vlan3 isn't related at all, most likely it's
> your upstream router on vlan3 that doesn't route packets coming from
> foreign source addresses (those belonging on vlan4).

I guess you are wrong - the guests are connected to a second NIC for the
internal LAN, and as the default route is not in the current network,
the first interface - which is the internal lan - is taken to send out
the packets. Sniffing with tcpdump on a ping on 212.18.0.5 shows
(212.18.0.5 is a DNS Server some hops away):

IP 192.168.200.99 > 192.168.200.99: ICMP 212.18.0.5 unreachable - need
to frag (mtu 1500), length 556
- -> this is going out on vlan4 with a wrong source address... !!!

13:35:19.145519 IP 212.18.24.193 > 192.168.200.99: ICMP time exceeded
in-transit, length 36
- -> this one commes in on eth1 as expected


>> * default route via both vlan concurrently
>> bad idea - route -n shows both routes inside the guest. No routing if
>> the first rule is the wrong vlan (thats soemwhat obvious)
> 
> Only the first one will be used, unless you do round-robin using nexthop.
> 
>> * source based routing entries with iproute2
>> removed the gerneal default route from the host, iproute2 settings are
>> not imported to the guest - so no routing at all....
> 
> This is what you want. There's no such thing as "imported to guest", if
> you set this up right, things will work.

So, how do I "set this up right"

Oliver

- --
Protect your environment -  close windows and adopt a penguin!
PGP-Key: 3B2C 8095 A7DF 8BB5 2CFF  8168 CAB7 B0DD 3985 1721
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIy6aRyrew3TmFFyERAtuIAJ4pXidI79hGddJKc1xkN7+Nnx2OGwCfRKTr
npDij/BERMoSy+Oc8wRFy8E=
=rdUk
-----END PGP SIGNATURE-----