Hi, On Wed, Sep 22, 2010 at 09:40:02AM +0100, Gordan Bobic wrote: > Doesn't this contradict what has already been said on this thread, > that guests-only networking can be done by assigning IPs on > loopback? If I add an IP 192.168.0.1/32, then this will not be able > to access 192.168.0.2/32 on another guest without routing, right? > And somebody said that using a dummy interface will just end up > getting re-written to lo. So, what is the right way to do an > internal guests-only "vlan" with vserver? Fortunately everything is much simpler within linux :-). Globally: 1) there is only one ipstack (*) 2) ip addresses are global to this ip stack, no matter on which interface 3) ip addresses on interfaces with subnets are only there as a shortcut for the routing table. You can just as wel add device routes to the ipstack. 4) For a device to matter to the ipstack it needs to have at least 1 IPv4 address. This can be 127.0.0.1/32 if you like ;-). Without it, the devicehandler won't send packets to the ipstack. Exceptions: 5) subnets on lo are a shortcut to say you *have* all those IP addresses in that subget. So your ipstack will answer any address discovery (ARP) for any ip in that subnet. There is no other meaning for a subnet on lo. This is different from a subnet on a real device: on a real device it just means that that subnet is reachable through that device. The ipstack doesn't hold all ip addresses, and hence won't answer arps for it. 6) 127.0.0.0/8 is an exception in the routing code. Without this exception, you would be perfectly able to route 127.0.0.0/8 out of a device. Vserver: Vserver network contexts are more or less filters on the ip's available on the host. *) To be complete you can have network namespaces which are complete ipstacks in itself. Just forget them for now. Going back to your problem: defining 192.168.0.1/32 and 192.168.0.2/32 on any device just adds those 2 addresses to the ipstack, and hence will make all routing local. ("Going over lo") So you don't need an extra device.