Wed, 21 Mar 2012 16:02:58 +0100 Hello Rod, > -----Ursprüngliche Nachricht----- > Von: Roderick A. Anderson [mailto:raanders42@gmail.com] > Gesendet: Mittwoch, 21. März 2012 15:04 > An: vserver@list.linux-vserver.org > Betreff: Re: AW: [vserver] IPtables, network namespaces > > Fiedler Roman wrote: > > Hello Christian, > > > > Full Network stack separation is not possible, but with newer kernel iptables > for guest separation are working and I'm using them quite frequently. > > > > Since guest cannot add new rules, all rules are created on host. Rules for > guests are in different files so that removal of rules together with guest is > easier. > > > > Tell me, if you are interested in (very simple) config examples > > I think many of us are interested. The LV systems I admin tend to run > servers (MX, NS, etc.) but there is some interest in providing guests > for clients. > > Yes please either post or but on the site. It is really not very sophisticated: * A simple debian package contains sysv-init script (/etc/init.d/iptablesfirewall) with 80 lines. The init script uses config-dir in etc with basic iptables configuration and a directory with plain shell scripts (confparts): /etc/init.d/iptablesfirewall: #!/bin/sh # start/stop the iptables firewall. When started, this script will # load a base iptables config and run addon scripts to complete # the configuration. # # Stop does not do anything at the moment. # # V2008-01-17 _init_confDir=/etc/local/iptablesfirewall _init_varRunDir=/var/run/iptablesfirewall if [ ! -d "${_init_confDir}" ]; then echo "Cannot find iptables configuration" exit 1 fi . "${_init_confDir}/config" if [ "${IptablesFirewallStart}" != "yes" ]; then echo "IptablesFirewall start disabled. Complete your configuration and edit ${_init_confDir}/config" exit 1 fi case "$1" in start) echo -n "Starting iptablesfirewall: " # Place a lock in /var/run mkdir -p -- "${_init_varRunDir}" if ! dotlockfile -l -p -r 100 "${_init_varRunDir}/start.lock"; then logger -i -t iptablesfirewall -- "Stale lock at start, ignoring it" # Proceed anyway with restart, quite likely that firwall start # completely last time fi if test -f "${_init_confDir}/modules"; then cat -- "${_init_confDir}/modules" | grep -v -E -e '^(#| *$)' | \ while read moduleName; do if ! modprobe "${moduleName}"; then echo "Failed to load ${moduleName}" >&2 fi done fi iptables-restore < "${_init_confDir}/Iptables-Base" if [ "${IptablesFirewallFilterIpv6}" = "yes" ]; then ip6tables-restore < "${_init_confDir}/Ip6tables-Base" elif test -e /proc/sys/net/ipv6/conf/all/disable_ipv6; then # Make sure to disable it, when not needed echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6 fi run-parts --exit-on-error "${_init_confDir}/confparts" _init_status="$?" dotlockfile -u -p "${_init_varRunDir}/start.lock" if [ "${_init_status}" = "0" ]; then echo "done." else echo "FAIL" exit "${_init_status}" fi ;; stop) echo -n "Stopping iptables: " echo "done." ;; restart) "$0" stop "$0" start ;; *) echo "Usage: $0 {start|stop|restart}" exit 1 ;; esac The iptables base rules just perform minimal init of default chains and logging, e.g. # Standard error chain: log, drop packet -A DROP-ERROR -j LOG --log-ip-options --log-prefix "iptables:DROP-ERROR " --log-uid -A DROP-ERROR -j DROP ############################################################################## # Forward filtering -A FORWARD -m state --state ESTABLISHED -j ACCEPT -A FORWARD -m state --state RELATED -j ACCEPT-INFO -A FORWARD -j DROP-ERROR .... * Configuration scripts add the new iptables rules. Runparts will just run them one after another, e.g. script confparts/30VsSomeprojectApplication #!/bin/bash -e # This script contains the rules for the application server . /etc/local/iptablesfirewall/config # Get loopback IP of guest _setup_context="$(cat -- "/etc/vservers/vs-someproject-application/context")" _setup_loopbackBase="127.$((${_setup_context}>>8)).$((${_setup_context}%256))" _setup_loopbackIp="${_setup_loopbackBase}.1" _setup_loopbackNet="${_setup_loopbackBase}.0/24" _setup_localVirtIp="${LocalVirtVsSomeprojectApplicationIp}" # Example for guest-only connection # Allow local access from # * Apache to tomcat (8080) iptables -A OUTPUT-LOCAL --source "${_setup_loopbackIp}" --destination "${_setup_loopbackIp}" -p tcp -m multiport --dports 8080 -m conntrack --ctstate NEW -j ACCEPT-INFO-TCP iptables -A INPUT-LOCAL --source "${_setup_loopbackIp}" --destination "${_setup_loopbackIp}" -p tcp -m multiport --dports 8080 -m conntrack --ctstate NEW -j ACCEPT-INFO-TCP # Example inter-guest connection # Allow access from application server iptables -A OUTPUT-LOCAL --source "${_setup_localVirtIp}" --destination "${LocalVirtVsSomeprojectStorageIp}" -p tcp -m multiport --dports 5432,8080 -m conntrack --ctstate NEW -j ACCEPT-INFO-TCP # Example for incoming connection (this needs natting since all vserver are only bound to host-internal IPs not exposed via external interface # Allow external access to tomcat server iptables -t nat -A PREROUTING -i "${MainInterfaceName}" --destination "${MainInterfaceIp}" -p tcp -m tcp --dport 8080 -j DNAT --to-destination "${LocalVirtVsSomeprojectApplicationIp}" iptables -A INPUT-GLOBAL -i "${MainInterfaceName}" --destination "${LocalVirtVsSomeprojectApplicationIp}" -p tcp -m tcp --dport 8080 -m conntrack --ctstate NEW --ctorigdst "${MainInterfaceIp}" -j ACCEPT-INFO-TCP * The scripts use common config file, which is just simple shell script again (/etc/local/iptablesfirewall/config) # Minimal IptablesFirewall configuration # If set to yes, then the iptables firewall can be started. Only # set flag when you have finished the complete configuration. IptablesFirewallStart=yes # If set to yes, IptablesFirewall will install a basic ipv6 # filtering configuration that will block all traffic, otherwise # ipv6 is disabled via /proc/sys/net/ipv6/conf/all/disable_ipv6 IptablesFirewallFilterIpv6=no MainInterfaceName=eth0 MainInterfaceIp=10.xx.xx.xx MainInterfaceNet=10.xx.xx.0/24 LocalVirtInterfaceNet=10.yy.yy.0/24 LocalVirtVsSomeprojectApplicationIp=10.yy.yy.2 LocalVirtVsSomeprojectStorageIp=10.yy.yy.3 NtpServerIps="10.xx.xx.xx ... That’s all. Everything else is in the firewall config shell scripts, some of them generated automatically during deployment. As you may have noted, this example has very flat chain hierarchy. With more firewall rules, creation of subchains is good idea, e.g. OUTPUT-LOCAL OUTPUT-LOCAL-PROJ-A ... Regards, Roman