Subject: Re: [vserver] Static Route on Loopback
From: Gordan Bobic <gordan@bobich.net>
Date: Mon, 18 Oct 2010 08:22:04 +0100

Herbert Poetzl wrote:
> On Sun, Oct 17, 2010 at 05:24:54PM +0100, Gordan Bobic wrote:
>> On 17/10/2010 17:07, Herbert Poetzl wrote:
>>> On Fri, Oct 15, 2010 at 01:08:22PM +0100, Gordan Bobic wrote:
>>>> The problem is that loopback reacts differently. It responds locally
>>>> to all addresses in the subnet.
> 
>>>> e.g. if you set your loopback 127.0.0.1/8, the localhost will
>>>> listen to ALL of the addresses in that subnet. If you set it for
>>>> 192.168.0.1/24, then ALL of the IPs in that subnet will get answered
>>>> by localhost, rather than passed out.
> 
>>>> Either way, the solution using a dummy NIC works. It turns out the lo
>>>> IP bindings were a hangover from before, after I removed them they
>>>> didn't come back, so it's all good.
> 
>>>> I think this is a point that's worth pointing in the dummy vs lo
>>>> argument. With lo, the routing and filtering can be quite unintuitive,
>>>> while dummy works exactly as you'd expect.
> 
>>> what's the point puting it on dummy, why not put it on
>>> the actual interface it will be using anyway, e.g. eth0
>>> (or whatever your traffic uses)?
> 
>> It won't be using an external interface. 
> 
> It won't be using dummy0 either 
>
>> This is for a guests-only internal interface.
> 
> there is no such thing in Linux-VServer

I know it's not using dummy0 per se, and it all ends up going over 
host's lo, but unlike with using lo on it's own, the routing on the 
private-only subnet works properly. If I set up additional IPs on lo 
with a /32 netmask, the IP seen by the other guests is that of the 
guest's real IP address, which is what I didn't want. Because on 
loopback I have to set the netmask of /32, the outgoing packets don't 
end up coming from that /32 address since the target IP isn't on that 
network.

Gordan