Subject: Re: [vserver] How can I filter traffic between guests?
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Thu, 20 May 2010 22:44:50 +0200

On Thu, May 20, 2010 at 07:02:14PM +0200, Jarry wrote:
> Hi, I have a question concerning networking: In FAQ there is
> an information that I can use iptables only on host, and all
> traffic is local. 

> What does it mean exactly? 

it means, that host-guest and guest-guest traffic
never leaves the host

> Is there any possibility to filter traffic between guests 
> (on the same host)?

yes, as networking happens on the host, the packets
will use the 'expected' path for local traffic

> Let's say, I have Guest1 with IP1 and Guest2 with IP2 (both
> from the same C-segment). In Guest1 I issue "ping IP2". Which
> iptables-chains (of host) is this traffic going through?

the OUTPUT and INPUT chain

> OUTPUT and INPUT (FAQ says it does not touch FORWARD)?

correct, as there doesn't happen any forwarding, i.e.
the packets directly go from one IP to the other ...

note that ping is a bad example, as it isn't really
IP traffic and will be answered by the host stack itself

> What about IP's, is source-ip IP1 and destination-ip IP2?
> And which interface will it use, eth0 or loopback?

guest assigned IPs will show up as source and destination
as can be expected, localhost (127.x.x.1) IPs will be
remapped (if lback remapping is enabled) and as it is
local traffic, it will use 'lo'

HTH,
Herbert

--
if you or your company use and like the Linux-VServer project, 
why not consider donating hardware or money, or getting a
service contract with the developers to ensure that it will
live on and continue to provide high quality free software?

> Jarry
> 
> -- 
> _______________________________________________________________
> This mailbox accepts e-mails only from selected mailing-lists!
> Everything else is considered to be spam and therefore deleted.