Subject: Re: [vserver] Virtual Host-Only Networking (tap?)
From: Gordan Bobic <gordan@bobich.net>
Date: Sat, 11 Sep 2010 11:19:07 +0100

On 09/11/2010 10:27 AM, Adrian Reyer wrote:
> On Sat, Sep 11, 2010 at 08:28:41AM +0800, Jeff Jansen wrote:
>> We use the 'dummy' interface for this. 'modprobe dummy' and now you've
>> got 'dummy0' as an interface on the host.  (You can also have dummy1,
>> dummy2, etc. by running 'modprobe numdummies=X' where 'X' is the number
>> of dummy interfaces you want.)
>
> We use 'lo:N' here and a private address range. What is the benefit of
> 'dummy'? Basic setup just nanmes 'lo' as
> /etc/vservers/NAME/interfaces/X/dev.

Interesting, this is exactly what I was thinking about myself initially, 
something like loopback interfaces on the same subnet, but I read 
somewhere that vserver guests' loopbacks either get transparently 
rewritten to the primary IP or that they get remapped to 127.a.b.1 where 
ab is the 16-bit context ID. If that is the case, then:

1) Does that mean I cannot/shoudn't use 127.0.0.0/8 range for the 
loobpack "network" for risk of IP clashes? From the host, ping returns 
packets for ANY address in the 127/8 range, and if I try ssh-ing to 
127.x.y.1, the port is closed (host is only listening on it's own 
address). So it seems some additional magic is going on.

2) I've found I don't actually need explicit devX:Y NIC aliases on the 
host to get networking to work. I can assign the guest an IP from the 
same subnet on the primary interface without aliases and it works fine, 
I can get ssh in and out of the guest. Can anyone explain what the deal 
is there? Is the devX:Y alias requirement a deprecated bit of 
documentation or am I doing something that is likely to cause me 
problems? Or am I misreading the docs, and the alias is only required if 
the NIC isn't already on the same subnet as the guests?

3) Would using lo fully expose the hosts's loopback interface, and if 
so, is it firewallable in the normal way?

I'm really curious now regarding the pros and cons of lo vs. dummy 
interfaces for private host-only networking.

And Adrian, are you implying that you are using non-127/8 address in lo 
aliases?

>> You can treat this just like any other interface on the host and assign
>> a different IP address to each guest and you have a truly host-only
>> networking device.
>
> Does this make the hosts iptables passing the 'FORWARD' chain? 'lo'
> won't.

Is there a particular reason to use the FORWARD chain rather than the 
INPUT chain?

Gordan