Subject: Re: [vserver] Networking setup question
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Wed, 18 Mar 2009 12:09:04 +0100

On Mon, Mar 16, 2009 at 12:41:53PM +0100, randall wrote:
> Matt Paine wrote:
> >Bit of a follow on with idea's from my previous email.
> >
> >I am having issues attaching services to my 10.0.0.1 address - 
> >firewalled mainly. As I do not want to open up many ports on eth0, 
> >should I be running the private network on a loopback interface, or 
> >virtual interface (tap??)
> >
> >Any hints greatly appreciated.
> 
> according to route -n the ip address 10.0.1.1 is not assigned to a 
> network card and it needs to be but you don't want a private IP 
> listening on a public interface.
> 
> what i personally do is to create a "virtual" network card and 
> let the VServer guests listen on that interface.

unfortunately this is a very common misconception

if it were true, and the guest would 'listen' on the
dummy0 interface, then it would listen for a long
time, as there will be no packets received from dummy0
and any packets transmitted to/through dummy0 will be
silently discarded (that's the purpose of dummy0)

> you can just add an extra interface like this
> (in debian you add it in /etc/network/interfaces)
> auto dummy0
> iface dummy0 inet static
>    address 192.168.1.1
>    netmask 255.255.255.0

> in order to be reachable i use shorewall to route the trafic i 
> want from external IP on eth0 to the VServer guest IP on dummy0.

which is the same you would do with the private IP
assigned to eth0 or lo or any other interface

best,
Herbert

> >Thankyou
> >Matt
> >mattsoftware.com
> >
> >
> >>Hi Guys.
> >>
> >>I am trying to achieve a private network behind my public internet. 
> >>Can anyone let me know where I am going wrong (or of its even 
> >>possible to do this??).
> >>
> >>
> >>Interfaces on the host:
> >>* eth0 (public internet, visible to the world)
> >>
> >>
> >>I have a PPTP server on the host which assigns 10.0.1.x addresses. I 
> >>want the clients to be able to communicate with the vserver guest.
> >>
> >>Guest is setup with interface 0...
> >>ip = 10.0.0.1
> >>mask = 255.0.0.0
> >>dev = eth0
> >>name=vps
> >>
> >>
> >>All the communication appears to be working fine, until the guest 
> >>tries to resolve a DNS entry. On closer inspection it doesn't seem 
> >>that that guest can ping any ip outside of the host....
> >>
> >>bash-3.2# ping 10.0.0.1
> >>PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
> >>64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.041 ms
> >>64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.022 ms
> >>64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.024 ms
> >>
> >>bash-3.2# ping 121.50.218.162
> >>PING 121.50.218.162 (121.50.218.162) 56(84) bytes of data.
> >>64 bytes from 121.50.218.162: icmp_seq=1 ttl=64 time=0.037 ms
> >>64 bytes from 121.50.218.162: icmp_seq=2 ttl=64 time=0.017 ms
> >>
> >>bash-3.2# ping 74.50.3.85
> >>PING 74.50.3.85 (74.50.3.85) 56(84) bytes of data.
> >>
> >>
> >>
> >>bash-3.2# route -n
> >>Kernel IP routing table
> >>Destination     Gateway         Genmask         Flags Metric Ref    
> >>Use Iface
> >>10.0.1.1        0.0.0.0         255.255.255.255 UH    0      0        
> >>0 *
> >>121.50.218.160  0.0.0.0         255.255.255.248 U     0      0        
> >>0 eth0
> >>169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        
> >>0 eth0
> >>10.0.0.0        0.0.0.0         255.0.0.0       U     0      0        
> >>0 eth0
> >>0.0.0.0         121.50.218.161  0.0.0.0         UG    0      0        
> >>0 eth0
> >>
> >>
> >>Any hints would be appreciated. (of course if you require any more 
> >>information let me know what you require and I'll provide :)
> >>
> >>
> >>Thankyou
> >>Matt.
> >>mattsoftware.com
> >>
> >
> 
> 
> -- 
> 
> www.songshu.org
> Just another collection of nuts