Difference between revisions of "Limit Networking on Multihomed hosts"

From Linux-VServer

Jump to: navigation, search
m (Situation)
(Issues added)
Line 21: Line 21:
 
ip rule add from net-VServer-B/mask table 101
 
ip rule add from net-VServer-B/mask table 101
 
</pre>
 
</pre>
 +
 +
== Issues ==
 +
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.

Revision as of 00:42, 14 January 2010

Situation

You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.

Solution

I used alternate routing tables:

Once (tested on Debian):

echo 100 vservera > /etc/iproute2/rt_tables
echo 101 vserverb > /etc/iproute2/rt_tables

After rebooting (write an init script)

ip route add IP-VServer-A/mask table vservera dev ethA
ip route add default table vservera via Gateway-A
ip route add IP-VServer-B/mask table vserverb dev ethB
ip route add default table vserverb via Gateway-B

ip rule add from net-VServer-A/mask table 100
ip rule add from net-VServer-B/mask table 101

Issues

Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.

Personal tools