Fiedler Roman wrote: >> -----Ursprüngliche Nachricht----- >> Von: Gordan Bobic [mailto:gordan@bobich.net] >> Gesendet: Mittwoch, 29. Februar 2012 12:43 >> An: vserver@list.linux-vserver.org >> Betreff: Re: [vserver] Using loopback for guest-guest and guest-host >> communication but still remapping >> >> Fiedler Roman wrote: >>> Hi, >>> >>> I'm trying to configure networking on a machine, where we cannot use any >> private network for internal communication because I might need to receive >> traffic from that network. So I can only use loopback, one private IP-Range IP >> (server external IP) and I do not want to grab one public IP-range for internal >> communication if avoidable. >>> Is this configuration with special combination of nflags and dev settings >> possible (CAVEAT: network prefixes atypical)? >>> * Guest ctx=3: Inside guest bind and connect to 127.0.0.1/24 is remapped >> to 127.0.3.1 and stays inside guest >>> * Guest ctx=4: Inside guest bind and connect to 127.0.0.1/24 is remapped >> to 127.0.4.1 and stays inside guest >>> * Guest ctx=3: Inside guest connect to 127.0.4.1/24 goes to guest ctx=4 >> network stack (inter-guest comm) >>> * Guest ctx=4: Inside guest connect to 127.0.3.1/24 goes to guest ctx=3 >> network stack (inter-guest comm) >>> * Guest ctx=3,4: Inside guest connects to any loopback IP-Range not bound >> to any guest goes to host, e.g. 127.255.255.1 (if something is listening on host >> on that IP/port) >>> >>> If not, would a special nflags, dev config configuration together with a >> modification of vserver patch (change 127.0.0.0/8 to 127.0.0.0/24 >> somewhere) be sufficient? >> >> I solved that problem by using a dummy interface for each internal-only >> network. You set up a dummy interface on the host, and give the guests >> an IP on that interface. > > I did a quick try of 10 configurations, but failed to get it working > in combination with remap. How did your network config look like? Special > nflags? Special kernel version or util-vservers? No, nothing special at all. Just create a dummy0 interface on the host, and each give each guest an IP on that interface. No remap required. > The one I'm trying to work on is (after startup of guest): > > Host: > ~# ip addr show > 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN > link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 > inet 127.0.0.1/24 scope host lo > inet 127.0.2.1/24 brd 127.0.2.255 scope host lo > 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 > inet 192.168.0.2/24 scope global eth0 > 3: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN > inet 127.0.1.1/24 brd 127.0.1.255 scope host dummy0 > inet 127.0.1.2/24 brd 127.0.1.255 scope host secondary dummy0 > > Guest vserver config: > > nflags: > ~single_ip,lback_allow > > Dev 0: lo, 127.0.2.1/24 (context is 2) > Dev 1: dummy0, 127.0.1.2/24 > > Guest ip addrs: > /# ip addr show > 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN > link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 > inet 127.0.0.1/24 scope host lo > inet 127.0.2.1/24 brd 127.0.2.255 scope host lo > 3: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN > link/ether 02:98:d9:0e:bd:a1 brd ff:ff:ff:ff:ff:ff > inet 127.0.1.2/24 brd 127.0.1.255 scope host secondary dummy0 > > Connect from guest to 127.0.1.1:80 is still remapped to 127.0.2.1, which is > guest itself. So no connection to host via lo possible. You are using 127/8 subnet on the dummy device - that won't work. You need a non-loopback IP range on the dummy interface, e.g. 192.168/16. Gordan