Subject: Re: [vserver] VServer with Host as Gateway
From: Daniel Hokka Zakrisson <daniel@hozac.com>
Date: Wed, 24 Oct 2007 22:24:11 +0200

Stuart Lester wrote:
> Well, I've figured out _a_ solution, though it may not be _the_ solution:
>   The virtual guest has two NICs, eth0 and eth1.  Traffic for the WAN
> goes out on eth0, Traffic for the LAN goes out on eth1.  Just like
> with the virtual host.  I had hoped to not do this, as it doesn't feel
> as "clean" as a single NIC for the virtual guest, but in some ways it
> is infinitely simpler than all the various routing schemes I've tried.

You shouldn't even need that (see below).

> Daniel...can you explain your statement below about getting stuck in a
> loop?  Traffic for me seems to be fine.

> routes_eth1=( "10.50.50.0/24 src 10.50.50.10 table 192net2")
> routes_eth1=( "10.50.50.0/24 src 10.50.50.1 table 192net2")
> routes_eth1=( "default via 10.50.50.1 table 192net2" )
> rules_eth1=( "from 10.50.50.0/24 table 192net2" )

You are basically saying "traffic from 10.50.50.0/24 should go to 
10.50.50.1", which is that box, rinse and repeat...

> My current configs are as follows (I can send the iptables commands if
> that is easier to read...none of it is particularly easy for me to
> decipher):
>   HOST ~ # iptables -L

Always use iptables -nvL, it shows more information and disables those 
darned lookups.

>   Chain INPUT (policy ACCEPT)
>   target     prot opt source               destination
> 
>   Chain FORWARD (policy DROP)
>   target     prot opt source               destination
>   ACCEPT     all  --  10.50.50.0/24        anywhere
>   ACCEPT     all  --  anywhere             10.50.50.0/24
> 
>   Chain OUTPUT (policy ACCEPT)
>   target     prot opt source               destination
> 
>   HOST ~ # iptables -t nat -L
>   Chain PREROUTING (policy ACCEPT)
>   target     prot opt source               destination
>   DNAT       tcp  --  anywhere             anywhere            tcp
> dpt:ssh to:10.50.50.1:22
> 
>   Chain POSTROUTING (policy ACCEPT)
>   target     prot opt source               destination
>   SNAT       all  --  anywhere             anywhere
> to:192.168.100.254

With this rule, the guest will never use its second IP address anyway.

>   Chain OUTPUT (policy ACCEPT)
>   target     prot opt source               destination
> 
> And for completeness, my /etc/conf.d/net looks like:
>   config_eth0=(
>           "192.168.100.253/24"
>           "192.168.100.254/24")
>   routes_eth0=( "default via 192.168.100.1" )
> 
>   config_eth1=(
>           "10.50.50.1/24"
>           "10.50.50.10/24"
>   )
> 
> Is there anything that you guys see in this that makes it a bad idea?
> The biggest flaw I see right now is that if/when I remove that linksys
> router from between this machine an the cable modem, I won't have the
> luxury of multiple IPs on eth0.
> 
> Stu

-- 
Daniel Hokka Zakrisson