Difference between revisions of "Limit Networking on Multihomed hosts"

From Linux-VServer

Jump to: navigation, search
(-cat)
 
Line 25: Line 25:
 
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.
 
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.
  
[[Category:Documentation]]
 
 
[[Category:Network related]]
 
[[Category:Network related]]

Latest revision as of 23:10, 21 October 2011

[edit] Situation

You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.

[edit] Solution

I used alternate routing tables:

Once (tested on Debian):

echo 100 vservera > /etc/iproute2/rt_tables
echo 101 vserverb > /etc/iproute2/rt_tables

After rebooting (write an init script)

ip route add IP-VServer-A/mask table vservera dev ethA
ip route add default table vservera via Gateway-A
ip route add IP-VServer-B/mask table vserverb dev ethB
ip route add default table vserverb via Gateway-B

ip rule add from net-VServer-A/mask table 100
ip rule add from net-VServer-B/mask table 101

[edit] Issues

Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.

Personal tools