Hi Herbert,
Many thanks for your advise and explanations.
Given the points you have made, I think I will do the following:
- Use the one subnet for both host and guest ip addresses,
(as I have many ip addresses available to me).
- Use the one eth0 interface for all these ip addresses,
(so that all these ip addresses can be accessed directly from other
systems in the network if necessary).
- Setup S/DNAT rules to redirect service traffic from host
ip address to services running on the guests, (so that services
can be advertised to consumers as being available on the host's ip
address and yet making it easy to switch the guest and its version of
the
service as you previously pointed out).
- Use other iptables rules to protect the hosts and guests appropriately.
This will enable me to switch between different guests and their service
by simply changing the S/DNAT rules (as you pointed out), but will also
allow other systems in the network to access the individual guests
directly, eg for ssh administration access.
Does this seem feasible or have I misunderstood some of you previous
points ?
Regards,
Declan