Herbert Poetzl wrote: > On Sun, Oct 17, 2010 at 05:24:54PM +0100, Gordan Bobic wrote: >> On 17/10/2010 17:07, Herbert Poetzl wrote: >>> On Fri, Oct 15, 2010 at 01:08:22PM +0100, Gordan Bobic wrote: >>>> The problem is that loopback reacts differently. It responds locally >>>> to all addresses in the subnet. > >>>> e.g. if you set your loopback 127.0.0.1/8, the localhost will >>>> listen to ALL of the addresses in that subnet. If you set it for >>>> 192.168.0.1/24, then ALL of the IPs in that subnet will get answered >>>> by localhost, rather than passed out. > >>>> Either way, the solution using a dummy NIC works. It turns out the lo >>>> IP bindings were a hangover from before, after I removed them they >>>> didn't come back, so it's all good. > >>>> I think this is a point that's worth pointing in the dummy vs lo >>>> argument. With lo, the routing and filtering can be quite unintuitive, >>>> while dummy works exactly as you'd expect. > >>> what's the point puting it on dummy, why not put it on >>> the actual interface it will be using anyway, e.g. eth0 >>> (or whatever your traffic uses)? > >> It won't be using an external interface. > > It won't be using dummy0 either > >> This is for a guests-only internal interface. > > there is no such thing in Linux-VServer I know it's not using dummy0 per se, and it all ends up going over host's lo, but unlike with using lo on it's own, the routing on the private-only subnet works properly. If I set up additional IPs on lo with a /32 netmask, the IP seen by the other guests is that of the guest's real IP address, which is what I didn't want. Because on loopback I have to set the netmask of /32, the outgoing packets don't end up coming from that /32 address since the target IP isn't on that network. Gordan