Limit Networking on Multihomed hosts: Difference between revisions

From Linix VServer
Jump to navigationJump to search
imported>AdrianReyer
(Created page with '== Situation == You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to e able to send packets over a specific network. == Solution == I …')
 
imported>Glenn
(-cat)
 
(4 intermediate revisions by 2 users not shown)
Line 1: Line 1:
== Situation ==
== Situation ==
You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to e able to send packets over a specific network.
You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.
 
== Solution ==
== Solution ==
I used alternate routing tables:
I used alternate routing tables:
Line 20: Line 21:
ip rule add from net-VServer-B/mask table 101
ip rule add from net-VServer-B/mask table 101
</pre>
</pre>
== Issues ==
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.
[[Category:Network related]]

Latest revision as of 22:10, 21 October 2011

Situation[edit]

You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.

Solution[edit]

I used alternate routing tables:

Once (tested on Debian):

echo 100 vservera > /etc/iproute2/rt_tables
echo 101 vserverb > /etc/iproute2/rt_tables

After rebooting (write an init script)

ip route add IP-VServer-A/mask table vservera dev ethA
ip route add default table vservera via Gateway-A
ip route add IP-VServer-B/mask table vserverb dev ethB
ip route add default table vserverb via Gateway-B

ip rule add from net-VServer-A/mask table 100
ip rule add from net-VServer-B/mask table 101

Issues[edit]

Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.