Subject: Re: [vserver] host-IP substituted by guest-IP ???
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Sun, 16 Aug 2009 23:01:40 +0200

On Sat, Aug 15, 2009 at 10:20:03PM +0200, Jarry wrote:
> Herbert Poetzl wrote:
> 
> >>It seems to me that for every connection from host, vserver-guest
> >>is substituting host's IP with its own guest's IP. WHY???
> >
> > - there are no 'host' or 'guest' IPs or even interfaces
> >   all addresses are configured on the host, and all
> >   networking happens on the host, the guests just get to
> >   'use' certain IPs for binding services to them
> >
> > - from the host perspective, all IPs (even those assigned
> >   to a guest) are local, so it is like the host is talking
> >   to itself.
> >
> >so, that means for your setup:
> >
> > - all host-guest or guest-guest traffic is local traffic
> >   which doesn't leave the host, and uses lo to transfer
> > - binding to 0.0.0.0 on the host will grab all IPs,
> >   including those assigned to guests
> > - source IP selection will happen according to the
> >   normal Linux network stack rules

> OK, but I do not understand one thing: why with guest->guest
> traffic everything is OK? When guest1 talks to guest2, in logs
> on guest2 there is a correct client (source) IP "guest1".
> Not IP of "guest2", as it is for host->guest2 traffic...

> How does host know, which of its IPs it has to select as
> source_IP when one guest talks to the other? 

because the guest is restricted to certain IPs (a subset
of the host IPs), the source address can only be chosen
among them (i.e. if you give a single IP to the guest, the
choice is trivial, and this single IP will be used for 
the source IP unconditionally)

> And when host can this for guest->guest traffic, why it can 
> not do the same "clever" source-IP selection for host->guest 
> traffic?

the host actually can do that, but as the initial set of
'potential' candidates includes all IPs (including that
of the guest) in your setup, the guest IP is the best
choice to make ...

note that with policy routing you can add specific rules
how the source addresses are chosen ...

> >>Can I somehow force guests to use correct host's IP?

the guest does never (and should never) 'use' what you
call 'host IP(s)', mainly because:

 a) the guest is not involved in the source IP selection
    in your example (i.e. it is basically done on the
    host, long before the packet reaches the guest)

 b) there is no such thing as 'host IP(s)' (because
    all IPs are host IPs, only some of them are assigned
    to guests too)

your request to 'force' the guest to use the 'right' IP
(the one you call host's IP) is like asking: 
"can I force all spam mail to be sent from all.spam.com,
 so that I can easily block it by source?"

> >the guest is not involved in your source IP selection, so
> >nothing in the guest (or its configuration) can affect that
> >the problem is with the host finding a suitable IP for your
> >host local request, and as you do not give any preference
> >the host chooses one address according to its rule set,
> >which might as well be the IP assigned to your guest
> >
> >you can use the 'normal' mechanism to control the source
> >IP selection, or you can specify the source IP on your
> >query, in any case, as long as the guest is reachable, it
> >will work out fine

> So can I somehow force host to use its "only real" IP
> for the whole host-guests traffic? Because now looking into
> guests' logs I can not say which traffic came from within
> the same guest, and which came from host...

now we are talking. well, yes and no ...

your options are these:

 a) when you 'connect' to a guest, use the proper source
    IP in your application/tool/whatever

 b) when you know, you have a service which doesn't allow
    you to select the source IP, you can use chbind to
    restrict your IP set to a subset (maybe just one) IP
    you want to use

 c) if you know that the connection always happens from
    the host to a guest, you can use the routing table
    to select a preferred source address for you

note that this very much depends on your host and guest
network setup, and without detailed knowledge it's very
hard to suggest anything

best,
Herbert

> Jarry
> 
> -- 
> _______________________________________________________________
> This mailbox accepts e-mails only from selected mailing-lists!
> Everything else is considered to be spam and therefore deleted.