From Linux-VServer

Revision as of 12:24, 17 September 2007 by Kapil (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Tips on Restricting Vserver Guest Network Access

These tips are being collected here because they seem scattered over the documentation. (Thanks to Bertl on #vserver for these tips).

Before doing anything else with Vserver Networking you should repeat the following mantras many times:

  1. Network routing policy is determined by the routing table on the host.
  2. The first interface defined in each guest is treated as the address of the loopback interface for the guest. (The Great Flower Page talks about the lback configuration; how does that work?)
  3. The guest can only establishing "listeners" on <IP address>:<port> combinations where <IP address> is an address that is "assigned" to the guest via an interface definition (or a call to naddress).
  4. All guest interfaces are also available to the host.

Most of the discussion below is based on vserver version 2.2 with util-vserver version 0.30.212. Newer versions have easier ways to achieve the same goals.

Network-less guest

Strictly speaking this is an "interface-less" guest rather than a network-less one. This is a guest that cannot make network connections and cannot be reached from the network since it has no network interfaces.

On a kernel with newer (>= 2.3?) vserver patches it should be possible to create a guest with no interfaces by keeping the directory /etc/vservers/<guest-name>/interfaces/ empty.

However, this does not work with Debian etch (util-vserver 0.30.212 and vserver 2.2). Instead, you get a guest with all host interfaces available for outgoing network connections. At the same time the guest cannot bind a server to these interfaces so one cannot reach the guest from the network.

To disable outgoing use of network interfaces under a kernel with the older (<= 2.2?) vserver patches, you proceed as follows. You create an interface directory (say /etc/vservers/<guest-name>/interfaces/0/) with the nodev configuration. Be sure to define an ip as this is verified first in /usr/lib/util-vserver/vserver.functions; the value in ip can be any IP address that is not an IP address of the host. (For example, an address like 192.168.x.y or 10.x.y.z which is chosen at random will not be a host address with some luck.) This will result in a non-existent host interface being "assigned" to the guest and thus "no" interface will be available to the guest.

Network-local guest

We now describe a configuration that leads to a guest that can (a priori) only connect to the host and can be reached via the network only from the host.

Define an interface using dummy0 as the value of dev and an ip value like 192.168.x.y or 10.x.y.z which is not an existing external-facing interface address for the host. (You may need to modprobe dummy in order to create such an interface.)

The guest can now connect to any service on the host that is listening for connections to <IP address>:80; where the IP address must be the one chosen above or the wildcard For example, if the host is running a web server that listens to, then (in the guest) one can run the command

socat - TCP:192.168.x.y:80

to connect to this server; where as before 192.168.x.y is the chosen IP address. On the guest, this command is equivalent to the command

socat - TCP:

Note that the address on the guest is equivalent to the chosen IP address but not on the host.

Similarly, the guest can start servers that listen to 192.168.x.y:8888 or providing that there is no server that is already listening to this address (on the guest or on the host). The host can connect to such a server using the command

socat - TCP:192.168.x.y:80

Both the above type of connections, guest-to-host or host-to-guest happen over the loopback network interface.

Suppose you do not want the guest to access specific services on the host. Then you use iptables to limit connections over the loopback port. For example,

iptables -A INPUT -d ! -i lo -j DROP

(To be continued) Kapil 12:24, 17 September 2007 (CEST)

Personal tools