Subject: Re: [vserver] guests to use dummy0 or eth0 ?
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Mon, 5 Jan 2009 14:41:18 +0100

On Mon, Jan 05, 2009 at 10:59:16PM +1100, Declan Mullen wrote:
> Hi
> 
> I want to do something which is probably very typical of virtual
> servers. I believe there are at least two techniques to do it (see
> below), but because I have not done it before I am not sure which
> technique is best or if both techniques are possible. I hope some of
> you can share your recommendations and why :

> I wish to set up a virtual server host with several guests. Each guest
> is to run a network service and I am intending on using the host's
> iptables to limit access to and in between the host and the guests
> and the other systems in the network. The network is a private subnet
> and there is no shortage of available ip addresses. The host has only
> one NIC (eth0). The only reason for running the network services in
> separate guests rather than running them all in the host, is for
> security. The network services are to include; apache2 web server,
> exim4 email, apt-cacher, bit torrent, scalix email.

> Initially I assumed the technique of building/configuring each guest
> to use the host's eth0 interface with their own unique ip address in
> the host's eth0 subnet.

> Then having browsed the virtual-server.org site I found an alternative
> technique of creating the dummy0 interface in the host with a
> ip address in a subnet different to eth0's subnet, and then
> building/configuring each guest to use the dummy0 interface with their
> own unique ip address in the host's dummy0 subnet. 

yep, that's the usual way, but note that the dummy0
interface is there for cosmetical purposes, i.e. it
is not used for anything except carrying the private
IPs (you could as well put them on eth0)

> And then allowing other systems in the network to access the network
> services either by using the host as a simple router 

that doesn't work, as there is no routing involved
between host and guest (they share the same stack)

> or by setting up port/service forwarding from host to relevant guest.

no forwarding either, but S/DNAT is the way to map
the shared public IP to private IPs carrying the
actual services ...

> Are there any particular reasons why I should use the dummy0 technique
> rather than the simpler eth0 technique ?

simple eth0 technique being?

if you mean, separate public IP for each guest ...
well the advantage is that you can do IP specific
stuff like ssl .. the disadvantage is that you
need more public IPs, in general the mapping to
private IPs has certain advantages in itself, mainly
that you are able to switch between different guests
by simply chaning the S/DNAT rule

> BTW, I'm using the current Debian Lenny distribution and its virtual
> server kernel image (version "2.6.26+17") with its virtual server
> version "2.3" and the "util-vserver" version is "0.30.216~r2772-4".
						~~~~~~~~~~~~~~~~~~~~~
better update that one, because this version is broken

> The "uname -a" output is "Linux max 2.6.26-1-vserver-686 #1 SMP Mon
> Dec 15 21:11:05 UTC 2008 i686 GNU/Linux".
> Thanks,
> Declan

best,
Herbert