Subject: Re: [vserver] tun parameters in interfaces/<iface>
From: Ed W <lists@wildgooses.com>
Date: Sat, 18 Jul 2009 17:20:56 +0100
Sat, 18 Jul 2009 17:20:56 +0100
John A. Sullivan III wrote:
> On Fri, 2009-07-17 at 18:26 -0400, John A. Sullivan III wrote:
>   
>> Hello, all.  May I ask what the purpose and syntax of
>> the /etc/vservers/<vserver name>/interfaces/<iface>/tun file is? I'm
>> exploring using OpenVPN as a client within a vserver.  The instructions
>> on the FAQ are starting to make sense although I do not know if they are
>> current.  But I'd like to understand what is happening when I take those
>> steps and why there seem to be many parameters pertaining to tun/tap
>> interaces listed on the Great Flower Page which are not referenced in
>> the FAQ.  Thanks - John
>>     
> Actually, as I think about running a client rather than a server the
> client's needs to add routes, etc., I almost wonder if I really need to
> run all the clients with all their different configs in the host and
> then use the source routing capabilities of iproute2 to send the
> appropriate vserver's traffic through the correct tunnel.  Sounds a bit
> dangerous but doable - John
>   

In general the vserver philisophy seems to be to disallow system type 
operations (such as mangling routes, etc) in the client and restrict 
these to the host.  Various IPC mechanisms allow you to do restricted 
communication back to the host to get it to do what you want.

Of course it's also entirely possible to grant the client access to the 
actual network stack and let it do what it wishes, but since this is not 
a virtualised type of system you also give the client the possibility to 
break things for everybody, and hence it's not recommended

I guess it depends on your exact needs and how much you trust stuff 
running in the clients?

If it's all done once at setup time for each client then I would have 
thought doing it in the host was the simplest option?

Good luck

Ed W


John A. Sullivan III wrote:
On Fri, 2009-07-17 at 18:26 -0400, John A. Sullivan III wrote:
  
Hello, all.  May I ask what the purpose and syntax of
the /etc/vservers/<vserver name>/interfaces/<iface>/tun file is? I'm
exploring using OpenVPN as a client within a vserver.  The instructions
on the FAQ are starting to make sense although I do not know if they are
current.  But I'd like to understand what is happening when I take those
steps and why there seem to be many parameters pertaining to tun/tap
interaces listed on the Great Flower Page which are not referenced in
the FAQ.  Thanks - John
    
Actually, as I think about running a client rather than a server the
client's needs to add routes, etc., I almost wonder if I really need to
run all the clients with all their different configs in the host and
then use the source routing capabilities of iproute2 to send the
appropriate vserver's traffic through the correct tunnel.  Sounds a bit
dangerous but doable - John
  

In general the vserver philisophy seems to be to disallow system type operations (such as mangling routes, etc) in the client and restrict these to the host.  Various IPC mechanisms allow you to do restricted communication back to the host to get it to do what you want.

Of course it's also entirely possible to grant the client access to the actual network stack and let it do what it wishes, but since this is not a virtualised type of system you also give the client the possibility to break things for everybody, and hence it's not recommended

I guess it depends on your exact needs and how much you trust stuff running in the clients?

If it's all done once at setup time for each client then I would have thought doing it in the host was the simplest option?

Good luck

Ed W