Subject: Re: [vserver] VServer with Host as Gateway
From: "Stuart Lester" <stuart.lester@gmail.com>
Date: Wed, 24 Oct 2007 17:24:48 -0400
Wed, 24 Oct 2007 17:24:48 -0400
On 10/24/07, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
> Stuart Lester wrote:
> > Daniel...can you explain your statement below about getting stuck in a
> > loop?  Traffic for me seems to be fine.
>
> > routes_eth1=( "10.50.50.0/24 src 10.50.50.10 table 192net2")
> > routes_eth1=( "10.50.50.0/24 src 10.50.50.1 table 192net2")
> > routes_eth1=( "default via 10.50.50.1 table 192net2" )
> > rules_eth1=( "from 10.50.50.0/24 table 192net2" )
>
> You are basically saying "traffic from 10.50.50.0/24 should go to
> 10.50.50.1", which is that box, rinse and repeat...

Gotcha.  FWIW, I believe that no loop was being created because gentoo's net
configs only allow one instance each of routes_ethX, so the subsequent lines
weren't being processed.  Additionally, I don't have any evidence that the
rules_ethX were _ever_ being processed...any gentoo experts out there care
to confirm this?

> > My current configs are as follows (I can send the iptables commands if
> > that is easier to read...none of it is particularly easy for me to
> > decipher):
> >   HOST ~ # iptables -L
>
> Always use iptables -nvL, it shows more information and disables those
> darned lookups.

Great tip, thanks!

> >   Chain POSTROUTING (policy ACCEPT)
> >   target     prot opt source               destination
> >   SNAT       all  --  anywhere             anywhere
> > to:192.168.100.254
>
> With this rule, the guest will never use its second IP address anyway.

Hot dog, you're right!  That solves my multiple IP issues...thanks.

BTW, someone also mentioned off-list that shorewall should do this as
well...I'm sure that it will (he even had a working config), but I decided
to try this method so as to not add another software package on top of this
that I'd have to figure out (at least at a superficial level).

Thanks to everyone for your suggestions and help,
Stu




On 10/24/07, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
> Stuart Lester wrote:
> > Daniel...can you explain your statement below about getting stuck in a
> > loop?  Traffic for me seems to be fine.
>
> > routes_eth1=( "10.50.50.0/24 src 10.50.50.10 table 192net2")
> > routes_eth1=( " 10.50.50.0/24 src 10.50.50.1 table 192net2")
> > routes_eth1=( "default via 10.50.50.1 table 192net2" )
> > rules_eth1=( "from 10.50.50.0/24 table 192net2" )
>
> You are basically saying "traffic from 10.50.50.0/24 should go to
> 10.50.50.1", which is that box, rinse and repeat...
 
Gotcha.  FWIW, I believe that no loop was being created because gentoo's net configs only allow one instance each of routes_ethX, so the subsequent lines weren't being processed.  Additionally, I don't have any evidence that the rules_ethX were _ever_ being processed...any gentoo experts out there care to confirm this?

> > My current configs are as follows (I can send the iptables commands if
> > that is easier to read...none of it is particularly easy for me to
> > decipher):
> >   HOST ~ # iptables -L
>
> Always use iptables -nvL, it shows more information and disables those
> darned lookups.

Great tip, thanks!

> >   Chain POSTROUTING (policy ACCEPT)
> >   target     prot opt source               destination
> >   SNAT       all  --  anywhere             anywhere
> > to:192.168.100.254
>
> With this rule, the guest will never use its second IP address anyway.

Hot dog, you're right!  That solves my multiple IP issues...thanks.

BTW, someone also mentioned off-list that shorewall should do this as well...I'm sure that it will (he even had a working config), but I decided to try this method so as to not add another software package on top of this that I'd have to figure out (at least at a superficial level).

Thanks to everyone for your suggestions and help,
Stu