On Fri, Dec 10, 2010 at 03:11:27PM +0100, Grzegorz Nosek wrote: > This is basically what I'm after, making the host a virtual > switch/router/firewall for the guests. Script type 2: ard@marvel:/root/vserver$ cat scripts/setup_network_namespace #!/bin/bash -x echo ARGS "$@" VSERVER="$2" VID="${VSERVER#v}" CLIENTDEV=${VSERVER}-client HOSTDEV=${VSERVER}-host BRIDGEDEV=br-vlan${VID} stringasmac() { echo "$1"|sed 's/\(..\)\(..\)\(..\)\(..\)\(..\)\(..\)/\1:\2:\3:\4:\5:\6/' } case "$1" in post-start) echo a PID: $! # Setup the vlan anyway you like it. I prefer ifup #ifup "${DEVNAME}" #ip link add link bond0 name "${DEVNAME}" type vlan id ${VID} read CONTEXTID < /etc/vservers/${VSERVER}/context echo $CONTEXTID MACSTRING=$(printf "%04x" $VID)$(printf "%04x" $CONTEXTID) MACADDRC=$(stringasmac 02${MACSTRING}00) MACADDRH=$(stringasmac 02${MACSTRING}01) ip link add name ${HOSTDEV} type veth peer name ${CLIENTDEV} ip link set address ${MACADDRC} dev ${CLIENTDEV} ip link set address ${MACADDRH} dev ${HOSTDEV} brctl addif ${BRIDGEDEV} ${HOSTDEV} vspace -e "$2" --net -- /usr/lib/util-vserver/vprocunhide vspace -e "$2" --net -- ip li set up dev lo vspace -e "$2" --net -- sh -c 'while echo $$;do :; done'|(read aPid;ip li set dev "$CLIENTDEV" netns $aPid) vspace -e "$2" --net -- ip a add `awk '/me-'${CLIENTDEV}'/ { print $1 $4 }' /etc/hosts` dev "${CLIENTDEV}" vspace -e "$2" --net -- ip li set up dev "${CLIENTDEV}" vspace -e "$2" --net -- ip ro add default via `awk '/gw-'${CLIENTDEV}'/ { print $1 }' /etc/hosts` ip li set up dev "${HOSTDEV}" ;; pre-stop) vspace -e "$2" --net -- ip li set down dev "${CLIENTDEV}" vspace -e "$2" --net -- ip li set down dev lo vspace -e "$2" --net -- ip link del "${CLIENTDEV}" ;; esac exit 0 Assumptions: guest is still called v${id} . In /etc/hosts a netmask is added behind the name: 1.1.1.1 me-vblaat-guest # /24 The only real difference with the other script is the creation of veth devices and thinking up the mac address. This was the part where I hit the wall when using post-start, while actually some "daemon" must be started in pre-initialize which can give the guest it's device when it exists, and the guest should have an init script that waits for the device to appear. I currently do not have a setup ready in which I can change and test the moving of the script to preinit. Anyway: have fun with it. BTW: I was trying to document this, but nothing but http://linux-vserver.org/util-vserver:SplitSharedNetworks came out of my head. I usually have an interpreter with me when talking to management and such, so that might explain a bit ;-).