Difference between revisions of "Networking vserver guests"

From Linux-VServer

Jump to: navigation, search
m (Introduction)
m (Host as router: format for printing)
Line 39: Line 39:
 
Configure the host to act as a router.
 
Configure the host to act as a router.
  
For internal packets going outside, pretend each packet came from our external IP:
+
For internal packets going outside, pretend each packet came from our external IP (put it in one line without backslash):
  # iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d ! 192.168.1.0/24 -j SNAT --to-source $EXTIP
+
  # iptables -t nat -A POSTROUTING -s 192.168.1.0/24 \
For each service that runs on a vserver, map it to an external port. Vserver local address <code>$VHOST</code> and port <code>$INTPORT</code> you select one external port <code>$EXTPORT</code> and run the following:
+
    -d ! 192.168.1.0/24 -j SNAT --to-source $EXTIP
  # iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 -m tcp -p tcp --dport $EXTPORT -j DNAT --to-destination $VHOST:$INTPORT
+
For each service that runs on a vserver, map it to an external port. Vserver local address <code>$VHOST</code> and port <code>$INTPORT</code> you select one external port <code>$EXTPORT</code> and run the following (put it in one line without backslash):
 +
  # iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 \
 +
    -m tcp -p tcp --dport $EXTPORT -j DNAT --to-destination $VHOST:$INTPORT
 
That's all!
 
That's all!
  

Revision as of 14:29, 21 February 2008

Setting up network access to and from your vserver guests.

Contents

Introduction

Lets imagine, you have only one external IP -- $EXTIP.

You want to have several vservers running without worrying about port overlapping.

Example:

Two vservers run a default webserver, running on port 80. If each "guest" vserver shares an IP with the host, then the two webservers will conflict.

One solution is:

  • All vservers are contained in a "virtual lan", say 192.168.1.x
  • Each vserver has its own IP
  • Control port forwarding on "parent" host. That is, run a router.

Configuration

Host

Set up dummy0 interface on the parent host

# /etc/network/interfaces on a Debian box, 
# configure on other distros with your preferred way
auto dummy0
iface dummy0 inet static
    address 192.168.1.250
    netmask 255.255.255.0

Guests

Set up each guest vserver:

cd /etc/vservers/$VSERVER/interfaces/0
echo dummy0 > dev
echo 192.168.1.1 > ip
echo 1 > name
echo 24 > prefix

Consider using a value of name equal to the last digit of the IP for easy separation.

Host as router

Configure the host to act as a router.

For internal packets going outside, pretend each packet came from our external IP (put it in one line without backslash):

# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 \ 
    -d ! 192.168.1.0/24 -j SNAT --to-source $EXTIP

For each service that runs on a vserver, map it to an external port. Vserver local address $VHOST and port $INTPORT you select one external port $EXTPORT and run the following (put it in one line without backslash):

# iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 \
    -m tcp -p tcp --dport $EXTPORT -j DNAT --to-destination $VHOST:$INTPORT

That's all!

Verifying

Try ping pool.ntp.org from your vserver -- it should ping fine.

Try to connect to your $EXTIP:$EXTPORT (from another external host) -- you will successfully connect to service running on a guest vserver.

See also

Personal tools