Help needed w/ vz networking: What terminology am I looking for?
Hi. Complete and under networking administration 'newb' but I do want to learn. Problem is, sometimes I don't know what the proper terms to google are... Here's the situation: I have a machine with two interfaces (eth0,eth1). eth0 is reserved for non-ve traffic, eth1 is reserved for ve traffic only. (I followed http://wiki.openvz.org/Multiple_Network_Interfaces_And_ARP_F lux regarding that) The lan domain is 'sleepy' (172.16.192.0/24) behind a pfsense firewall/router. I would like the ve's to have their own domain 'dopey' (172.16.91.0/24) but be able to have dns resolution across the whole network in both directions. (eg .sleepy machines can ping dns names of .dopey machines and visa versa) Right now I cannot, for the life of me, figure out how to get traffic routed across much less set up dns resolution unless I set up the ve's on the primary lan domain in which case everything works without the need for configuration. I'm going to guess this has to do with iptables but beyond that I'm lost. Is this SNAT? DNAT? Both? Something else entirely? First, I guess I should ask if this is even possible. If it is what specifically do I need to research to get this working? Many thanks and regards.
Re: Help needed w/ vz networking: What terminology am I looking for?
DNS and IP connectivity are rather orthogonal. So, let's figure 2 issues: 1) you want that VEs with IPs from 172.16.91.0/24 pool could ping nodes with IPs from 172.16.192.0/24 pool and vice versa; 2) you want that there will be transparent DNS configuration, such that you may avoid using direct IPs, but use DNS names instead. In order to resolve first issue, one need to know configuration of IP protocol on the node, where VEs run ('ip a l', 'ip r l', 'iptables-save' commands). And only when first issue will be resolved, than one could check the second one.
Hi Dim. Thank you for the response. I ran the commands from inside the ve, as you suggested, but I guess I'm not certain what I'm supposed to be looking for. root@test:~# ip a l 1: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo inet6 ::1/128 scope host valid_lft forever preferred_lft forever 3: venet0: <BROADCAST,POINTOPOINT,NOARP,UP,10000> mtu 1500 qdisc noqueue link/void inet 127.0.0.1/32 scope host venet0 inet 172.16.91.102/32 scope global venet0:0 root@test:~# ip r l 192.0.2.1 dev venet0 scope link default via 192.0.2.1 dev venet0 root@test:~# iptables-save # Generated by iptables-save v1.3.6 on Sat Jul 7 03:27:47 2007 *mangle :PREROUTING ACCEPT [178:16453] :INPUT ACCEPT [178:16453] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [126:17277] :POSTROUTING ACCEPT [126:17277] COMMIT # Completed on Sat Jul 7 03:27:47 2007 # Generated by iptables-save v1.3.6 on Sat Jul 7 03:27:47 2007 *filter :INPUT ACCEPT [186:16869] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [135:18385] COMMIT # Completed on Sat Jul 7 03:27:47 2007 Is it the ve or the hn I should be concerned with? Regards and thanks.
you must run the commands on the hn not the ve's since the hn is doing all the packet routing. You need to explain in more detail your network configuration because i didn't understood correctly what you have there... So, you have ONE HN. TWO subnets: 172.16.91.0/24 and 172.16.192.0/24 (used only by the ve's ?) TWO network cards on the HN. What address is each interface using ? After that you paste the output from the commands,run on the HN, Dim told you.
Please, post also output of above commands from HN.