Subject: How to make VServer-Guest to use other NIC than the VServer-Host
From:Marcus Mülbüsch <m.muelbuesch@googlemail.com>
Date: Thu, 02 Sep 2010 14:55:35 +0200

Hello all,

    I have a server with two NICs. I'd like to have the host use one of 
the NICs (with a 192.168.1.x-address), while the Guest uses the other 
NIC only (with a 192.168.2.x).

    This sort of puts the guest into the DMZ, while I can reach the host 
in the internal net, and then enter the guest.

    While that it is not as good as putting the whole machine into the 
DMZ it saves on hardware and keeps the infrastructure small.

    First, is there anything basically wrong with that reasoning? It may 
be easier to break out from a VServer guest into the host as breaking 
through another firewall, but not by much.

    Second, and here is where my problem starts:

- The second NIC (eth1) is not assigned an IP address on the host.

- The VServer is assigned eth1 as its one and only NIC.
/etc/vservers/myserver/interfaces/0/dev ./ip and ./prefix are set to 
"eth1", "192.168.3.x", and "24" respectively.

- Now, when the VServer is started, something "interesting" happens - 
Even though eth0 is not activated, it shows up with "ip route show", 
though as "if1"

192.168.3.0/24 dev eth1  proto kernel  scope link  src 192.168.3.x
192.168.1.0/24 dev if1  proto kernel  scope link  src 192.168.1.x
127.0.0.0/8 dev if3  scope link
default via 192.168.1.x dev if1

    Especially annoying is the fact that the default gateway is the one 
of the Vserver Host. No wonder it doesn't work.

    I could change the routing on the host, using "ip route del" and "ip 
route add". However that would mean to give the guest "NET_ADMIN" 
capability; which means it is a very bad idea.

    I feel I'm missing something very basic about either VServers or 
Advanced Routing :)

    What am I doing wrong?

I'm using Versions:
     Kernel: 2.6.22-vs2.2.0.7-gentoo
     VS-API: 0x00020200
     util-vserver: 0.30.215; Jan 13 2010, 12:12:31

Thanks for any help or pointers,

Marcus