Fiedler Roman wrote: > >> -----Ursprüngliche Nachricht----- >> Von: Gordan Bobic [mailto:gordan@bobich.net] >> >> Fiedler Roman wrote: >>>> -----Ursprüngliche Nachricht----- >>>> Von: Gordan Bobic [mailto:gordan@bobich.net] >>>> >>>> Fiedler Roman wrote: >>>>>> -----Ursprüngliche Nachricht----- >>>>>> Von: Gordan Bobic [mailto:gordan@bobich.net] >>>>>> >>>>>>> Fiedler Roman wrote: >>>>>>> .... >>>>>>> I'm trying to configure networking on a machine, where we cannot use >> any >>>>>>> private network for internal communication because I might need to >> receive >>>>>>> traffic from that network. So I can only use loopback, one private IP- >> Range IP >>>>>>> (server external IP) and I do not want to grab one public IP-range for >> internal >>>>>>> communication if avoidable. >>>> .... >>>>> Connect from guest to 127.0.1.1:80 is still remapped to 127.0.2.1, which >> is >>>>> guest itself. So no connection to host via lo possible. >>>> You are using 127/8 subnet on the dummy device - that won't work. You >>>> need a non-loopback IP range on the dummy interface, e.g. 192.168/16. >>> Thanks for your reply. I already used configuration with non-127 dummy >> interface >>> and they are working. In current use case (description above), I have the >> problem, >>> that organization cannot tell me, which private network is not in use at their >>> location. Since I cannot handle requests from their network if I bind IPs to >> local >>> interface, I was trying to do it without need of any other IPs than from range >>> 127.0.0.0/8. >> That is most unfortunate, but I don't see a workaround - they will have >> to find a suitable small private subnet in 10/8, 172.16/12 or 192.168/16 >> that you can use. But since that subnet will never be routable outside >> the machine itself, you can re-use it on all similar servers. >> >>> Things I could try: >>> ... >>> * Use iptables mangle or nat and mark to remap external requests from IP- >> Range also bound to local interface. >> >> Sorry, not sure I quite follow what you think you can do here. Can you >> elaborate? > > When I have some client with IP x accessing the machine and machine knows IP x on dummy interface, routing table entry to dummy interface will be used for e.g. tcp response packets, thus sending them to nirvana. > > If I mark connections depending on the interface, I should be possible to do policy routing, thus sending responses to connections from external-x back via external interface, while keeping internal-x connections internal. That gets quite hairy. Much better to just use a routable non-dedicated subnet. As I mentioned in my previous email, you should be able to use the link-local subnet for this sort of thing. Gordan