Difference between revisions of "Limit Networking on Multihomed hosts"

From Linux-VServer

Jump to: navigation, search
(Issues added)
(+cat)
Line 24: Line 24:
 
== Issues ==
 
== Issues ==
 
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.
 
Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.
 +
 +
[[Category:Documentation]]

Revision as of 20:20, 21 October 2011

Situation

You have a multihomed host, e.g. DMZ and LAN or different DMZs and want a single VServer only to be able to send packets over a specific network.

Solution

I used alternate routing tables:

Once (tested on Debian):

echo 100 vservera > /etc/iproute2/rt_tables
echo 101 vserverb > /etc/iproute2/rt_tables

After rebooting (write an init script)

ip route add IP-VServer-A/mask table vservera dev ethA
ip route add default table vservera via Gateway-A
ip route add IP-VServer-B/mask table vserverb dev ethB
ip route add default table vserverb via Gateway-B

ip rule add from net-VServer-A/mask table 100
ip rule add from net-VServer-B/mask table 101

Issues

Traffic between IPs on the same host won't go the routes outside the host, you need to set up iptables here.

Personal tools