Networking vserver guests

From Linux-VServer

Revision as of 21:31, 29 May 2007 by Mstrobert (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Private networking

Lets imagine, you have only one external IP -- $EXTIP.

You want to have several vservers running without worrying about port overlapping.


Two vservers run a default webserver, running on port 80. If each "guest" vserver shares an IP with the host, then the two webservers will confict.

One solution is:

  • All vservers are contained in a "virtual lan", say 192.168.1.x
  • Each vserver has its own IP
  • Control port forwarding on "parent" host. That is, run a router.

This is how to set it up:

1. Set up dummy0 interface on the parent host

# /etc/network/interfaces on a Debian box, 
# configure on other distros with your preferred way
auto dummy0
iface dummy0 inet static

2. Set up each guest vserver:

cd /etc/vservers/$VSERVER/interfaces/0
echo dummy0 > dev
echo > ip
echo 1 > name
echo 24 > prefix

I suggest you use value of name equal to last digit of the IP -- for easy separation.

3. Now, configure the host to act as a router.

3a: For internal packets going outside, pretend each packet came from our external IP:

iptables -t nat -A POSTROUTING -s -d ! -j SNAT --to-source $EXTIP

3b: For each service that runs on a vserver, map it to an external port. Vserver local address $VHOST and port $INTPORT you select one external port $EXTPORT and run the following:

iptables -t nat -A PREROUTING -s ! -m tcp -p tcp --dport $EXTPORT -j DNAT --to-destination $VHOST:$INTPORT

That's all!

Try ping from your vserver -- it should ping fine.

Try to connect to your $EXTIP:$EXTPORT (from another external host) -- you will successfully connect to service running on a guest vserver.

Personal tools