Limit Networking on Multihomed hosts: Difference between revisions

From Linix VServer
Jump to navigationJump to search
imported>AdrianReyer
(Issues added)
imported>Glenn
(-cat)
 
(2 intermediate revisions by the same user not shown)
Line 24: Line 24:
== Issues ==
== Issues ==
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.
[[Category:Network related]]

Latest revision as of 22:10, 21 October 2011

Situation[edit]

You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.

Solution[edit]

I used alternate routing tables:

Once (tested on Debian):

echo 100 vservera > /etc/iproute2/rt_tables
echo 101 vserverb > /etc/iproute2/rt_tables

After rebooting (write an init script)

ip route add IP-VServer-A/mask table vservera dev ethA
ip route add default table vservera via Gateway-A
ip route add IP-VServer-B/mask table vserverb dev ethB
ip route add default table vserverb via Gateway-B

ip rule add from net-VServer-A/mask table 100
ip rule add from net-VServer-B/mask table 101

Issues[edit]

Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.