Subject: Re: [vserver] Routing of vserver guests on multihomed hosts
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 17 Sep 2008 00:32:16 +0200

On Tue, Sep 16, 2008 at 11:50:19PM +0200, Oliver Welter wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi György
> 
> PÁSZTOR György schrieb:
> > Hi!
> > 
> > "Oliver Welter" <mail@oliwel.de> írta 2008-09-13 13:40-kor:
> >>> This is what you want. There's no such thing as "imported to guest", if
> >>> you set this up right, things will work.
> >> So, how do I "set this up right"
> > Have you read the tutorial at lartc.org?
> > If you have read and understood this:
> > http://lartc.org/howto/lartc.rpdb.multiple-links.html#AEN268
> > than quote your routing tables and route policy here, to let us see where
> > the problem is. (If still there is)
> 
> My Setup is similar to this, but its not doing fpr the reasons I gave in
> this post. But here is my config, the .99 IPs are the ones from the
> testing guest.
> 
> ~# ip addr
> 1: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
>     link/ether 00:40:d0:c0:18:cf brd ff:ff:ff:ff:ff:ff
> 2: eth1: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
>     link/ether 00:40:d0:c0:18:d0 brd ff:ff:ff:ff:ff:ff
>     inet 192.168.200.9/24 brd 192.168.200.255 scope global eth1
>     inet 192.168.200.99/24 brd 192.168.200.255 scope global secondary eth1
> 3: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
>     inet 127.0.0.1/8 scope host lo
> 4: vlan3@eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue
>     link/ether 00:40:d0:c0:18:cf brd ff:ff:ff:ff:ff:ff
>     inet 82.135.58.9/25 brd 82.135.58.127 scope global vlan3
>     inet 82.135.58.99/25 brd 82.135.58.127 scope global secondary vlan3
> 5: vlan4@eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue
>     link/ether 00:40:d0:c0:18:cf brd ff:ff:ff:ff:ff:ff
>     inet 212.18.24.209/26 brd 212.18.24.255 scope global vlan4
> 
> ~# ip rule
> 0:      from all lookup 255
> 32764:  from 212.18.24.192/26 lookup 104
> 32765:  from 82.135.58.0/25 lookup 103
> 32766:  from all lookup main
> 32767:  from all lookup default
> 
> ~# ip route list table 103
> 82.135.58.0/25 dev vlan3  scope link
> default via 82.135.58.1 dev vlan3

if your guest has an ip in 192.168.200.0/24 too, then
you either want to have an entry like this

   192.168.200.0/24 dev eth1  scope link

here too, or block packets to the 192.168.200.0/24
addresses or handle the fact that the wrong src ip
is used ... in any case, an explicit 'src xxx' is
advised on all network entries

> ~# ip route list table 104
> 212.18.24.192/26 dev vlan4  scope link
> default via 212.18.24.193 dev vlan4

same here

HTH,
Herbert

> ~# ip route list table main
> 212.18.24.192/26 dev vlan4  proto kernel  scope link  src 212.18.24.209
> 82.135.58.0/25 dev vlan3  proto kernel  scope link  src 82.135.58.9
> 192.168.200.0/24 dev eth1  scope link
> default via 212.18.24.193 dev vlan4
> 
> Oliver
> - --
> Protect your environment -  close windows and adopt a penguin!
> PGP-Key: 3B2C 8095 A7DF 8BB5 2CFF  8168 CAB7 B0DD 3985 1721
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.7 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iD8DBQFI0Cobyrew3TmFFyERArV4AJ4jH9Mtyjy3Kh+xcIICxrMq/y6IogCeNp/E
> mZ5PSxN7aWbGz6kQXIua6Pg=
> =mURb
> -----END PGP SIGNATURE-----