Subject: AW: [vserver] Using loopback for guest-guest and guest-host communication but still remapping
From: Fiedler Roman <Roman.Fiedler@ait.ac.at>
Date: Wed, 29 Feb 2012 13:13:59 +0100

 Wed, 29 Feb 2012 13:13:59 +0100
> -----Ursprüngliche Nachricht-----
> Von: Gordan Bobic [mailto:gordan@bobich.net]
> Gesendet: Mittwoch, 29. Februar 2012 12:43
> An: vserver@list.linux-vserver.org
> Betreff: Re: [vserver] Using loopback for guest-guest and guest-host
> communication but still remapping
> 
> Fiedler Roman wrote:
> > Hi,
> >
> > I'm trying to configure networking on a machine, where we cannot use any
> private network for internal communication because I might need to receive
> traffic from that network.  So I can only use loopback, one private IP-Range IP
> (server external IP) and I do not want to grab one public IP-range for internal
> communication if avoidable.
> >
> > Is this configuration with special combination of nflags and dev settings
> possible (CAVEAT: network prefixes atypical)?
> >
> > * Guest ctx=3: Inside guest bind and connect to 127.0.0.1/24 is remapped
> to 127.0.3.1 and stays inside guest
> > * Guest ctx=4: Inside guest bind and connect to 127.0.0.1/24 is remapped
> to 127.0.4.1 and stays inside guest
> >
> > * Guest ctx=3: Inside guest connect to 127.0.4.1/24 goes to guest ctx=4
> network stack (inter-guest comm)
> > * Guest ctx=4: Inside guest connect to 127.0.3.1/24 goes to guest ctx=3
> network stack (inter-guest comm)
> >
> > * Guest ctx=3,4: Inside guest connects to any loopback IP-Range not bound
> to any guest goes to host, e.g. 127.255.255.1 (if something is listening on host
> on that IP/port)
> >
> >
> > If not, would a special nflags, dev config configuration together with a
> modification of vserver patch (change 127.0.0.0/8 to 127.0.0.0/24
> somewhere) be sufficient?
> 
> I solved that problem by using a dummy interface for each internal-only
> network. You set up a dummy interface on the host, and give the guests
> an IP on that interface.

I  did a quick try of 10 configurations, but failed to get it working in combination
with remap. How did your network config look like? Special nflags? Special kernel version
or util-vservers?

The one I'm trying to work on is (after startup of guest):

Host:
~# ip addr show
1: lo: <LOOPBACK,UP,LOWER UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/24 scope host lo
    inet 127.0.2.1/24 brd 127.0.2.255 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER UP> mtu 1500 qdisc pfifo fast state UP qlen 1000
    inet 192.168.0.2/24 scope global eth0
3: dummy0: <BROADCAST,NOARP,UP,LOWER UP> mtu 1500 qdisc noqueue state UNKNOWN 
    inet 127.0.1.1/24 brd 127.0.1.255 scope host dummy0
    inet 127.0.1.2/24 brd 127.0.1.255 scope host secondary dummy0

Guest vserver config:

nflags:
~single ip,lback allow

Dev 0: lo, 127.0.2.1/24  (context is 2)
Dev 1: dummy0, 127.0.1.2/24

Guest ip addrs:
/# ip addr show
1: lo: <LOOPBACK,UP,LOWER UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/24 scope host lo
    inet 127.0.2.1/24 brd 127.0.2.255 scope host lo
3: dummy0: <BROADCAST,NOARP,UP,LOWER UP> mtu 1500 qdisc noqueue state UNKNOWN 
    link/ether 02:98:d9:0e:bd:a1 brd ff:ff:ff:ff:ff:ff
    inet 127.0.1.2/24 brd 127.0.1.255 scope host secondary dummy0

Connect from guest to 127.0.1.1:80 is still remapped to 127.0.2.1, which is guest itself.
So no connection to host via lo possible.