Limit Networking on Multihomed hosts: Difference between revisions
From Linix VServer
Jump to navigationJump to search
imported>AdrianReyer (Created page with '== Situation == You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to e able to send packets over a specific network. == Solution == I …') |
imported>Glenn (-cat) |
||
| (4 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
== Situation == | == Situation == | ||
You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to | You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network. | ||
== Solution == | == Solution == | ||
I used alternate routing tables: | I used alternate routing tables: | ||
| Line 20: | Line 21: | ||
ip rule add from net-VServer-B/mask table 101 | ip rule add from net-VServer-B/mask table 101 | ||
</pre> | </pre> | ||
== Issues == | |||
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here. | |||
[[Category:Network related]] | |||
Latest revision as of 22:10, 21 October 2011
Situation[edit]
You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.
Solution[edit]
I used alternate routing tables:
Once (tested on Debian):
echo 100 vservera > /etc/iproute2/rt_tables echo 101 vserverb > /etc/iproute2/rt_tables
After rebooting (write an init script)
ip route add IP-VServer-A/mask table vservera dev ethA ip route add default table vservera via Gateway-A ip route add IP-VServer-B/mask table vserverb dev ethB ip route add default table vserverb via Gateway-B ip rule add from net-VServer-A/mask table 100 ip rule add from net-VServer-B/mask table 101
Issues[edit]
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.