Difference between revisions of "Networking vserver guests"
From Linux-VServer
m (→Host as router: format for printing) |
m (→Host as router: format for printing) |
||
| Line 41: | Line 41: | ||
For internal packets going outside, pretend each packet came from our external IP (put it in one line without backslash): | For internal packets going outside, pretend each packet came from our external IP (put it in one line without backslash): | ||
# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 \ | # iptables -t nat -A POSTROUTING -s 192.168.1.0/24 \ | ||
| − | + | -d ! 192.168.1.0/24 -j SNAT --to-source $EXTIP | |
For each service that runs on a vserver, map it to an external port. Vserver local address <code>$VHOST</code> and port <code>$INTPORT</code> you select one external port <code>$EXTPORT</code> and run the following (put it in one line without backslash): | For each service that runs on a vserver, map it to an external port. Vserver local address <code>$VHOST</code> and port <code>$INTPORT</code> you select one external port <code>$EXTPORT</code> and run the following (put it in one line without backslash): | ||
# iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 \ | # iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 \ | ||
| − | + | -m tcp -p tcp --dport $EXTPORT | |
| + | -j DNAT --to-destination $VHOST:$INTPORT | ||
That's all! | That's all! | ||
Revision as of 14:39, 21 February 2008
Setting up network access to and from your vserver guests.
Contents |
Introduction
Lets imagine, you have only one external IP -- $EXTIP.
You want to have several vservers running without worrying about port overlapping.
Example:
Two vservers run a default webserver, running on port 80. If each "guest" vserver shares an IP with the host, then the two webservers will conflict.
One solution is:
- All vservers are contained in a "virtual lan", say 192.168.1.x
- Each vserver has its own IP
- Control port forwarding on "parent" host. That is, run a router.
Configuration
Host
Set up dummy0 interface on the parent host
# /etc/network/interfaces on a Debian box,
# configure on other distros with your preferred way
auto dummy0
iface dummy0 inet static
address 192.168.1.250
netmask 255.255.255.0
Guests
Set up each guest vserver:
cd /etc/vservers/$VSERVER/interfaces/0 echo dummy0 > dev echo 192.168.1.1 > ip echo 1 > name echo 24 > prefix
Consider using a value of name equal to the last digit of the IP for easy separation.
Host as router
Configure the host to act as a router.
For internal packets going outside, pretend each packet came from our external IP (put it in one line without backslash):
# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 \ -d ! 192.168.1.0/24 -j SNAT --to-source $EXTIP
For each service that runs on a vserver, map it to an external port. Vserver local address $VHOST and port $INTPORT you select one external port $EXTPORT and run the following (put it in one line without backslash):
# iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 \ -m tcp -p tcp --dport $EXTPORT -j DNAT --to-destination $VHOST:$INTPORT
That's all!
Verifying
Try ping pool.ntp.org from your vserver -- it should ping fine.
Try to connect to your $EXTIP:$EXTPORT (from another external host) -- you will successfully connect to service running on a guest vserver.
