Limit Networking on Multihomed hosts: Difference between revisions

From Linix VServer
Jump to navigationJump to search
imported>Glenn
imported>Glenn
(-cat)
 
Line 25: Line 25:
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.


[[Category:Documentation]]
[[Category:Network related]]
[[Category:Network related]]

Latest revision as of 22:10, 21 October 2011

Situation[edit]

You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.

Solution[edit]

I used alternate routing tables:

Once (tested on Debian):

echo 100 vservera > /etc/iproute2/rt_tables
echo 101 vserverb > /etc/iproute2/rt_tables

After rebooting (write an init script)

ip route add IP-VServer-A/mask table vservera dev ethA
ip route add default table vservera via Gateway-A
ip route add IP-VServer-B/mask table vserverb dev ethB
ip route add default table vserverb via Gateway-B

ip rule add from net-VServer-A/mask table 100
ip rule add from net-VServer-B/mask table 101

Issues[edit]

Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.