Networking vserver guests - Revision history

Glenn: -cat

2011-10-21T22:09:01Z

-cat

Glenn: catchg

2011-10-21T21:29:30Z

catchg

Glenn: +cat

2011-10-21T19:18:16Z

+cat

80.67.176.232: /* Host as router */ deprecated syntax for second iptables command

2011-07-20T12:34:36Z

‎Host as router: deprecated syntax for second iptables command

83.85.124.128: /* Guests */

2010-11-06T13:03:03Z

‎Guests

79.204.254.46: /* Guests */

2010-10-04T14:19:17Z

‎Guests

189.208.132.152: /* Host as router */

2010-03-03T22:58:18Z

‎Host as router

Bobnormal: /* Guests */

2010-02-15T14:22:44Z

‎Guests

Bobnormal: /* Process */

2010-02-15T14:22:06Z

‎Process

Bobnormal: /* Configuration */

2010-02-15T14:16:38Z

‎Configuration

← Older revision		Revision as of 22:09, 21 October 2011
Line 79:		Line 79:
	[[Category:HowTo]]		[[Category:HowTo]]
	[[Category:Network related]]		[[Category:Network related]]
−	~~[[Category:Documentation]]~~

@@ Line 78: / Line 78: @@
 [[Category:HowTo]]
-[[Category:Network]]
+[[Category:Network related]]
 [[Category:Documentation]]

← Older revision		Revision as of 19:18, 21 October 2011
Line 79:		Line 79:
	[[Category:HowTo]]		[[Category:HowTo]]
	[[Category:Network]]		[[Category:Network]]
		+	[[Category:Documentation]]

@@ Line 62: / Line 62: @@
   # iptables -t nat -A POSTROUTING -s 192.168.1.0/24 \
     ! -d  192.168.1.0/24 -j SNAT --to-source $EXTIP
-For each service that runs on a vserver, map it to an external port. Vserver local address <code>$VHOST</code> and port <code>$INTPORT</code> you select one external port <code>$EXTPORT</code> and run the following (put it in one line without backslash):
+For each service that runs on a vserver, map it to an external port. (For each ?) Vserver local address <code>$VHOST</code> and port <code>$INTPORT</code>, you select one external port <code>$EXTPORT</code> and run the following (put it in one line without backslash):
-  # iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 \
+  # iptables -t nat -A PREROUTING ! -s 192.168.1.0/24 \
     -m tcp -p tcp --dport $EXTPORT
     -j DNAT --to-destination $VHOST:$INTPORT

@@ Line 49: / Line 49: @@
   cd /etc/vservers/$VSERVER/interfaces/0
-  echo eth0 > dev
+  echo dummy0 > dev
   echo 192.168.1.1 > ip
   echo 1 > name

@@ Line 46: / Line 46: @@
 ===Guests===
-Set up each guest vserver.  If you skipped the above step, replace dummy0 with the name of your host's primary network interface, for example eth0.
+Set up each guest vserver.  If you skipped the host configuration above, you will need to replace dummy0 with the name of your host's primary network interface, for example eth0.
   cd /etc/vservers/$VSERVER/interfaces/0

@@ Line 39: / Line 39: @@
       address 192.168.1.250
       netmask 255.255.255.0
 ===Guests===

@@ Line 23: / Line 23: @@
 ====Why?====
-This driver allows you to associate vServer guests with a ''virtual'' network device rather than the host's real network interface, which functions to hide packet counters from vServer guests.  There is no other use for this step, so feel free to skip it if you are not worried about sharing packet counters.  Packet counts ''may'' be useful to an attacker with control of a vServer guest who wishes to perform side-channel attacks during cryptanalysis, or network traffic analysis against your host or other vServer guests.  If you did not understand the last sentence and your installation is not particularly security sensitive, then the chances that you will encounter a skilled attacker are slim to none and you should feel free to skip this section.
+This driver allows you to associate vServer guests with a ''virtual'' network device rather than the host's real network interface, which functions to hide packet counters from vServer guests.  '''There is no other use for this step''', so feel free to skip it if you are not worried about sharing packet counters.  (Packet counts ''may'' be useful to an attacker with control of a vServer guest who wishes to perform side-channel attacks during cryptanalysis, or network traffic analysis against your host or other vServer guests.  If you did not understand the last sentence and your installation is not particularly security sensitive, then the chances that you will encounter a skilled attacker and this will actually matter are slim to none and you should feel free to skip this section.)
 ====Process====
-First you need to load the dummy interface driver
+First you need to load the dummy interface driver (requires CONFIG_DUMMY=m in your kernel configuration)
   # modprobe dummy