Art -kwaak- van Breemen wrote: > Hi, > > On Wed, Sep 22, 2010 at 09:40:02AM +0100, Gordan Bobic wrote: >> Doesn't this contradict what has already been said on this thread, >> that guests-only networking can be done by assigning IPs on >> loopback? If I add an IP 192.168.0.1/32, then this will not be able >> to access 192.168.0.2/32 on another guest without routing, right? >> And somebody said that using a dummy interface will just end up >> getting re-written to lo. So, what is the right way to do an >> internal guests-only "vlan" with vserver? > > Fortunately everything is much simpler within linux :-). > Globally: > 1) there is only one ipstack (*) > 2) ip addresses are global to this ip stack, no matter on which > interface > 3) ip addresses on interfaces with subnets are only there as a > shortcut for the routing table. You can just as wel add device > routes to the ipstack. > 4) For a device to matter to the ipstack it needs to have at > least 1 IPv4 address. This can be 127.0.0.1/32 if you like ;-). > Without it, the devicehandler won't send packets to the ipstack. > > Exceptions: > 5) subnets on lo are a shortcut to say you *have* all those > IP addresses in that subget. So your ipstack will answer any > address discovery (ARP) for any ip in that subnet. There is no > other meaning for a subnet on lo. > This is different from a subnet on a real device: on a real > device it just means that that subnet is reachable through that > device. The ipstack doesn't hold all ip addresses, and hence > won't answer arps for it. > 6) 127.0.0.0/8 is an exception in the routing code. Without this > exception, you would be perfectly able to route 127.0.0.0/8 out > of a device. > > Vserver: > Vserver network contexts are more or less filters on the ip's > available on the host. > > *) To be complete you can have network namespaces which are > complete ipstacks in itself. Just forget them for now. > > > Going back to your problem: defining 192.168.0.1/32 and > 192.168.0.2/32 on any device just adds those 2 addresses to the > ipstack, and hence will make all routing local. ("Going over lo") > So you don't need an extra device. That is a most excellent, comprehensive explanation. Thanks. :) Gordan