Difference between revisions of "Networking vserver guests"

From Linux-VServer

Jump to: navigation, search
(Host as router: added root-prompt symbol to commands)
(-cat)
 
(27 intermediate revisions by 14 users not shown)
Line 9: Line 9:
 
Example:
 
Example:
  
Two vservers run a default webserver, running on port 80. If each "guest" vserver shares an IP with the host, then the two webservers will confict.
+
Two vservers run a default webserver, running on port 80. If each "guest" vserver shares an IP with the host, then the two webservers will conflict.
  
 
One solution is:
 
One solution is:
Line 19: Line 19:
 
==Configuration==
 
==Configuration==
 
===Host===
 
===Host===
Set up dummy0 interface on the parent host
+
 
 +
===Optional: Load 'dummy' device(s)===
 +
 
 +
====Why?====
 +
This driver allows you to associate vServer guests with a ''virtual'' network device rather than the host's real network interface, which functions to hide packet counters from vServer guests.  '''There is no other use for this step''', so feel free to skip it if you are not worried about sharing packet counters.  (Packet counts ''may'' be useful to an attacker with control of a vServer guest who wishes to perform side-channel attacks during cryptanalysis, or network traffic analysis against your host or other vServer guests.  If you did not understand the last sentence and your installation is not particularly security sensitive, then the chances that you will encounter a skilled attacker and this will actually matter are slim to none and you should feel free to skip this section.)
 +
 
 +
====Process====
 +
First you need to load the dummy interface driver (requires CONFIG_DUMMY=m in your kernel configuration)
 +
# modprobe dummy
 +
 
 +
To have it automatically loaded on startup, add
 +
"loopback" to /etc/modules
 +
 
 +
Set up <code>dummy0</code> interface on the parent host
 
  # /etc/network/interfaces on a Debian box,  
 
  # /etc/network/interfaces on a Debian box,  
 
  # configure on other distros with your preferred way
 
  # configure on other distros with your preferred way
Line 26: Line 39:
 
     address 192.168.1.250
 
     address 192.168.1.250
 
     netmask 255.255.255.0
 
     netmask 255.255.255.0
 +
 +
====Optional Extra Step====
 +
It is possible to facilitate further segregation (such that even dummy packet counters are never shared between guests).  To do so, use:
 +
# modprobe dummy numdummies=<number-of-devices-required>
 +
... and associate each vServer with a unique dummy device.
  
 
===Guests===
 
===Guests===
Set up each guest vserver:
+
Set up each guest vserver.  If you skipped the host configuration above, you will need to replace dummy0 with the name of your host's primary network interface, for example eth0.
 +
 
 
  cd /etc/vservers/$VSERVER/interfaces/0
 
  cd /etc/vservers/$VSERVER/interfaces/0
 
  echo dummy0 > dev
 
  echo dummy0 > dev
Line 34: Line 53:
 
  echo 1 > name
 
  echo 1 > name
 
  echo 24 > prefix
 
  echo 24 > prefix
I suggest you use value of <code>name</code> equal to last digit of the IP -- for easy separation.
+
 
 +
Consider using a value of <code>name</code> equal to the last digit of the IP for easy separation.
  
 
===Host as router===
 
===Host as router===
 
Configure the host to act as a router.
 
Configure the host to act as a router.
  
For internal packets going outside, pretend each packet came from our external IP:
+
For internal packets going outside, pretend each packet came from our external IP (put it in one line without backslash):
  # iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d ! 192.168.1.0/24 -j SNAT --to-source $EXTIP
+
  # iptables -t nat -A POSTROUTING -s 192.168.1.0/24 \
For each service that runs on a vserver, map it to an external port. Vserver local address <code>$VHOST</code> and port <code>$INTPORT</code> you select one external port <code>$EXTPORT</code> and run the following:
+
  ! -d 192.168.1.0/24 -j SNAT --to-source $EXTIP
  # iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 -m tcp -p tcp --dport $EXTPORT -j DNAT --to-destination $VHOST:$INTPORT
+
For each service that runs on a vserver, map it to an external port. (For each ?) Vserver local address <code>$VHOST</code> and port <code>$INTPORT</code>, you select one external port <code>$EXTPORT</code> and run the following (put it in one line without backslash):
 +
  # iptables -t nat -A PREROUTING ! -s 192.168.1.0/24 \
 +
  -m tcp -p tcp --dport $EXTPORT  
 +
  -j DNAT --to-destination $VHOST:$INTPORT
 
That's all!
 
That's all!
  
Line 49: Line 72:
  
 
Try to connect to your <code>$EXTIP:$EXTPORT</code> (from another external host) -- you will successfully connect to service running on a guest vserver.
 
Try to connect to your <code>$EXTIP:$EXTPORT</code> (from another external host) -- you will successfully connect to service running on a guest vserver.
 +
==See also==
 +
* [[Frequently_Asked_Questions#If_my_host_has_only_one_a_single_public_IP.2C_can_I_use_RFC1918_IP_.28e.g._192.168.foo.bar.29_for_the_guest_vservers.3F |FAQ on private networking]]
 +
* [[Frequently_Asked_Questions#When_I_try_to_ssh_to_the_guest.2C_I_log_into_the_host.2C_even_if_I_installed_sshd_on_the_guest._What.27s_wrong_here.3F |Permit guest sshd to bind to its IP address's port 22]]
 +
* [[Networking_vserver_guests_RHEL|Networking_vserver_guests_RHEL]]
 +
 +
[[Category:HowTo]]
 +
[[Category:Network related]]

Latest revision as of 23:09, 21 October 2011

Setting up network access to and from your vserver guests.

Contents

[edit] Introduction

Lets imagine, you have only one external IP -- $EXTIP.

You want to have several vservers running without worrying about port overlapping.

Example:

Two vservers run a default webserver, running on port 80. If each "guest" vserver shares an IP with the host, then the two webservers will conflict.

One solution is:

  • All vservers are contained in a "virtual lan", say 192.168.1.x
  • Each vserver has its own IP
  • Control port forwarding on "parent" host. That is, run a router.

[edit] Configuration

[edit] Host

[edit] Optional: Load 'dummy' device(s)

[edit] Why?

This driver allows you to associate vServer guests with a virtual network device rather than the host's real network interface, which functions to hide packet counters from vServer guests. There is no other use for this step, so feel free to skip it if you are not worried about sharing packet counters. (Packet counts may be useful to an attacker with control of a vServer guest who wishes to perform side-channel attacks during cryptanalysis, or network traffic analysis against your host or other vServer guests. If you did not understand the last sentence and your installation is not particularly security sensitive, then the chances that you will encounter a skilled attacker and this will actually matter are slim to none and you should feel free to skip this section.)

[edit] Process

First you need to load the dummy interface driver (requires CONFIG_DUMMY=m in your kernel configuration)

# modprobe dummy

To have it automatically loaded on startup, add "loopback" to /etc/modules

Set up dummy0 interface on the parent host

# /etc/network/interfaces on a Debian box, 
# configure on other distros with your preferred way
auto dummy0
iface dummy0 inet static
    address 192.168.1.250
    netmask 255.255.255.0

[edit] Optional Extra Step

It is possible to facilitate further segregation (such that even dummy packet counters are never shared between guests). To do so, use:

# modprobe dummy numdummies=<number-of-devices-required>

... and associate each vServer with a unique dummy device.

[edit] Guests

Set up each guest vserver. If you skipped the host configuration above, you will need to replace dummy0 with the name of your host's primary network interface, for example eth0.

cd /etc/vservers/$VSERVER/interfaces/0
echo dummy0 > dev
echo 192.168.1.1 > ip
echo 1 > name
echo 24 > prefix

Consider using a value of name equal to the last digit of the IP for easy separation.

[edit] Host as router

Configure the host to act as a router.

For internal packets going outside, pretend each packet came from our external IP (put it in one line without backslash):

# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 \ 
  ! -d  192.168.1.0/24 -j SNAT --to-source $EXTIP

For each service that runs on a vserver, map it to an external port. (For each ?) Vserver local address $VHOST and port $INTPORT, you select one external port $EXTPORT and run the following (put it in one line without backslash):

# iptables -t nat -A PREROUTING ! -s 192.168.1.0/24 \
  -m tcp -p tcp --dport $EXTPORT 
  -j DNAT --to-destination $VHOST:$INTPORT

That's all!

[edit] Verifying

Try ping pool.ntp.org from your vserver -- it should ping fine.

Try to connect to your $EXTIP:$EXTPORT (from another external host) -- you will successfully connect to service running on a guest vserver.

[edit] See also

Personal tools