Difference between revisions of "Limit Networking on Multihomed hosts"
From Linux-VServer
(+cat) |
(-cat) |
||
| (One intermediate revision by one user not shown) | |||
| Line 25: | Line 25: | ||
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here. | Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here. | ||
| − | [[Category: | + | [[Category:Network related]] |
Latest revision as of 23:10, 21 October 2011
[edit] Situation
You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.
[edit] Solution
I used alternate routing tables:
Once (tested on Debian):
echo 100 vservera > /etc/iproute2/rt_tables echo 101 vserverb > /etc/iproute2/rt_tables
After rebooting (write an init script)
ip route add IP-VServer-A/mask table vservera dev ethA ip route add default table vservera via Gateway-A ip route add IP-VServer-B/mask table vserverb dev ethB ip route add default table vserverb via Gateway-B ip rule add from net-VServer-A/mask table 100 ip rule add from net-VServer-B/mask table 101
[edit] Issues
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.
