Subject: Re: [vserver] Virtual Host-Only Networking (tap?)
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Sun, 12 Sep 2010 18:24:10 +0200

On Sat, Sep 11, 2010 at 11:19:07AM +0100, Gordan Bobic wrote:
> On 09/11/2010 10:27 AM, Adrian Reyer wrote:
> >On Sat, Sep 11, 2010 at 08:28:41AM +0800, Jeff Jansen wrote:
> >>We use the 'dummy' interface for this. 'modprobe dummy' and now
> >>you've got 'dummy0' as an interface on the host. (You can also have
> >>dummy1, dummy2, etc. by running 'modprobe numdummies=X' where 'X' is
> >>the number of dummy interfaces you want.)

> >We use 'lo:N' here and a private address range. What is the benefit of
> >'dummy'? Basic setup just nanmes 'lo' as
> >/etc/vservers/NAME/interfaces/X/dev.

> Interesting, this is exactly what I was thinking about myself
> initially, something like loopback interfaces on the same subnet,
> but I read somewhere that vserver guests' loopbacks either get
> transparently rewritten to the primary IP or that they get remapped
> to 127.a.b.1 where ab is the 16-bit context ID. If that is the case,
> then:
> 
> 1) Does that mean I cannot/shoudn't use 127.0.0.0/8 range for the 
>    loobpack "network" for risk of IP clashes? i
>    From the host, ping returns packets for ANY address in the 
>    127/8 range, and if I try ssh-ing to 127.x.y.1, the port is 
>    closed (host is only listening on it's own 
>    address). So it seems some additional magic is going on.

the 'magic' here is twofold, first, 127. is handled specially
by the kernel (mainline), as all 127. addresses are considered
existing and reachable, second, the lback mapping (if used)
will map _all_ of them to the guest assigned lback address and
in turn, map that address back to 127.0.0.1

> 2) I've found I don't actually need explicit devX:Y NIC aliases on
>    the host to get networking to work. I can assign the guest an 
>    IP from the same subnet on the primary interface without 
>    aliases and it works fine, I can get ssh in and out of the guest. 
>    Can anyone explain what the deal is there? 

aliases were introduced about 15 years ago, and they were the
only way to add a second IP to an existing interface, about a
decade ago, the notion of 'secondary' IP addresses was introduced,
which basically replaced the old-fashioned aliases ...

>    Is the devX:Y alias requirement a deprecated bit of documentation 
>    or am I doing something that is likely to cause me problems? 

which documentation?
basically you can still use aliases but modern linux systems
(those using iproute2) usually utilize secondaries instead of
aliases

>    Or am I misreading the docs, and the alias is only required
>    if the NIC isn't already on the same subnet as the guests?

there is no case where an alias would be 'required', but you
want to use aliases when 'ifconfig' is the only tool you have
because it is too old to see secondaries :)

> 3) Would using lo fully expose the hosts's loopback interface, 

depends on the config (lback and the remapping stuff)

>    and if so, is it firewallable in the normal way?

iptables apply to all host/guest traffic as well as networ/guest
traffic, so setting up proper rules will take care of all cases

>    I'm really curious now regarding the pros and cons of lo 
>    vs. dummy interfaces for private host-only networking.

there is no pro for dummy interfaces, but it seems that folks
cannot wrap their heads around using lo, instead they use
dummy and create a bunch of mythical explanations why the
dummy interface is the best way to do that :)

> And Adrian, are you implying that you are using non-127/8 address in lo 
> aliases?

> >>You can treat this just like any other interface on the host and
> >>assign a different IP address to each guest and you have a truly
> >>host-only networking device.

> >Does this make the hosts iptables passing the 'FORWARD' chain? 'lo'
> >won't.

> Is there a particular reason to use the FORWARD chain rather than the 
> INPUT chain?

traffic which is 'forwared' passes the FORWARD chain, which,
except for certain buggy kernel versions, is not the case
for local traffic (note that all host/guest traffic is local)

HTC,
Herbert

> Gordan