Subject: Re: [vserver] 3 basic questions
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Mon, 10 Aug 2009 13:41:54 +0200

On Mon, Aug 10, 2009 at 07:37:22PM +1200, Michael wrote:
> Why not to make something sinmilart to openvz - optiuonallly 
> emaulte eth?

because it already exists in recent kernels ... it is
called 'network namespaces'

> I think it will make a great improvents to vserver.

not really, as basically all things can be done a lot
more efficient and with less 'strange effects' on the
host (regarding networking)

> PS. I like vserver so mush ( but don't have all required skill 
> to extend it.) emulation of eth will let to use iptaBLES, 

which can also be done (a lot more securely) with a 
policy daemon on the host, and a proxy on the guest 

> VPN, 

which already runs inside guests, as tun devices can
be 'assigned' to a guest as well

> DHCPD, 

which doesn't make much sense in a guest, as it is
not at the IP layer (but yeah, that should be possible
with network namespaces)

> SAMBA,, ETC...

which works perfectly fine inside a guest as well

so, what would be the big advantage again?

note: 95% of the 'virtual networkstack requests' originate
from users which want to run a proprietary management
panel which is too dumb to work without iptables, so IMHO
they can be ignored (i.e. bug the company behind the panel :)

so, could you elaborate why you _need_ to run iptables
on the host again please?

best,
Herbert

> On Mon, Aug 10, 2009 at 11:38 AM, Ed W<lists@wildgooses.com> wrote:
> > Michael wrote:
> >>
> >> Is it possible to use iptables in VPS?
> >> The only part that holds me into openvz.
> >>
> >> I need to use iptables inside VPS not on the host.
> >>
> >>
> >
> > Someone else will no doubt correct me, but as I understand it you can grant
> > any guest any capability you wish, including the ability to fart with the
> > network stack.  However, obviously any guest which can run iptables can
> > implicitly also take down the network card and potentially cause problems
> > for other instances sharing that card (ie the network stack ain't
> > virtualised)
> >
> > If this isn't a problem I think you just grant your image a capabilities
> > flag and off you go?
> >
> > Another option would be to setup some kind of IPC back to the host and that
> > would then vet the iptables options and implement them on your behalf... I
> > think this has been discussed in more oblique forms before, but not sure how
> > easy it would be to google for these threads... (perhaps on "ipc"?)
> >
> > I think a final issue is that the vservers appear to iptables as local
> > processes (which they are) and this has certain implications for the way you
> > need to use iptables which are a bit peculiar and catch a bunch of folks
> > out.  Basically stuff doesn't go through the forward chain like you might
> > expect, but only sits on the INPUT (or something like that??)
> >
> > Good luck
> >
> > Ed W
> >
> 
> 
> 
> -- 
> --
> Michael