OpenVZ Forum


Home » General » Support » *SOLVED* Access two subnets on two different NICs from VE with venet adapter
*SOLVED* Access two subnets on two different NICs from VE with venet adapter [message #14258] Wed, 20 June 2007 15:34 Go to next message
christoph is currently offline  christoph
Messages: 19
Registered: July 2006
Junior Member
Hello!

I've the following problem, when I like to access two different subnets on two different NICs on HN from a VE with venet adapter.

Ok, here is my situation in detail.

HN: eth0 10.0.0.101/24
eth1 192.168.255.1/24

VE: venet0:0 10.0.0.123
venet0:1 192.168.255.33

Now I try to ping to some other machine on the network from within the VE.
-bash-3.00# ping 10.0.0.102
PING 10.0.0.102 (10.0.0.102) 56(84) bytes of data.
64 bytes from 10.0.0.102: icmp_seq=0 ttl=63 time=0.138 ms
64 bytes from 10.0.0.102: icmp_seq=1 ttl=63 time=0.135 ms

--- 10.0.0.102 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.135/0.136/0.138/0.011 ms, pipe 2
-bash-3.00# ping 192.168.255.2
PING 192.168.255.2 (192.168.255.2) 56(84) bytes of data.

--- 192.168.255.2 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 1999ms

-bash-3.00# logout
exited from VE 1001
[root@HN ~]# ping 192.168.255.2
PING 192.168.255.2 (192.168.255.2) 56(84) bytes of data.
64 bytes from 192.168.255.2: icmp_seq=0 ttl=64 time=0.176 ms


I also checked with tcpdump on 192.168.255.2 and found out that the echo request arrives, but with a source IP of 10.0.0.123.

I don't want to use the veth adapter for security reasons.
How can I best solve that problem with venet adapter?

Thank you,
Christoph

[Updated on: Thu, 28 June 2007 07:36] by Moderator

Report message to a moderator

Re: Access two subnets on two different NICs from VE with venet adapter [message #14276 is a reply to message #14258] Thu, 21 June 2007 10:23 Go to previous messageGo to next message
Andrey Mirkin is currently offline  Andrey Mirkin
Messages: 193
Registered: May 2006
Senior Member
You need to use source based routing (http://wiki.openvz.org/Source_based_routing)

Andrey Mirkin
http://static.openvz.org/userbars/openvz-developer.png
Re: Access two subnets on two different NICs from VE with venet adapter [message #14281 is a reply to message #14276] Thu, 21 June 2007 13:14 Go to previous messageGo to next message
christoph is currently offline  christoph
Messages: 19
Registered: July 2006
Junior Member
Andrey,

thank you for your response.
I already checked the source based routing page before, however I wasn't really able to get it working.

I tried the following additional rule:
# ip rule show 
0:      from all lookup local 
32765:  from all to 192.168.255.0/24 lookup 123 
32766:  from all lookup main 
32767:  from all lookup default 
# ip route show table 123
default dev eth1  scope link


Any hints?

Thank you,
Christoph
Re: Access two subnets on two different NICs from VE with venet adapter [message #14294 is a reply to message #14276] Thu, 21 June 2007 15:18 Go to previous messageGo to next message
christoph is currently offline  christoph
Messages: 19
Registered: July 2006
Junior Member
Hello Andrey,

I just found a solution for my problem.

First I ensured that ip_conntrack was enabled for VE0.

Then I added the following iptables rule, and now it works fine:
iptables -t nat -A POSTROUTING -d 192.168.255.0/24 -j MASQUERADE -o eth1


Do you see any disadvantage in that way?

Christoph
Re: Access two subnets on two different NICs from VE with venet adapter [message #14314 is a reply to message #14294] Fri, 22 June 2007 08:03 Go to previous messageGo to next message
Andrey Mirkin is currently offline  Andrey Mirkin
Messages: 193
Registered: May 2006
Senior Member
conntracks are not needed in this case.
You just need to add correct route inside VE for 192.168.255.0 subnetwork.

In your case:

venet0:0 10.0.0.123
venet0:1 192.168.255.33

# ip ro add 192.168.255.0/24 dev venet0 src 192.168.255.33


That's all.


Andrey Mirkin
http://static.openvz.org/userbars/openvz-developer.png
Re: Access two subnets on two different NICs from VE with venet adapter [message #14373 is a reply to message #14314] Tue, 26 June 2007 13:46 Go to previous messageGo to next message
christoph is currently offline  christoph
Messages: 19
Registered: July 2006
Junior Member
Andrey,

perfect, that's really the way to go!

Thank you,
Christoph
Re: *SOLVED* Access two subnets on two different NICs from VE with venet adapter [message #30218 is a reply to message #14258] Fri, 16 May 2008 15:05 Go to previous messageGo to next message
kraln is currently offline  kraln
Messages: 1
Registered: May 2008
Junior Member
I think I have a similar issue.

I have two subnets assigned to me, but only one interface (and one default route). I managed to fix this once, but when I just had to reboot the machine, one of the subnets stopped working.

I have 38.100.42.248/29, HN is 38.100.42.250, 38.100.42.249 is the default gateway.

I also have 38.105.84.192/28.

When the machine came back up, the nodes in the 38.100.42.248 subnet all work but the ones in the 38.105.84.192 subnet all don't.

I don't have any iptables or such malarky running. Help?

(more info:)

[root@pyxis ~]# vzlist
      VEID      NPROC STATUS  IP_ADDR         
       100         66 running 38.100.42.251   
       101          6 running 38.100.42.252   
       105         37 running 38.100.42.253   
       197         10 running 38.105.84.197   
       199          8 running 38.105.84.199   
       200          3 running 38.100.42.254   
       201          6 running 38.105.84.201   
       202         23 running 38.105.84.202   

[root@pyxis ~]# ip r
38.105.84.197 dev venet0  scope link 
38.105.84.199 dev venet0  scope link 
38.100.42.251 dev venet0  scope link 
38.100.42.252 dev venet0  scope link 
38.105.84.201 dev venet0  scope link 
38.100.42.253 dev venet0  scope link 
38.105.84.202 dev venet0  scope link 
38.100.42.254 dev venet0  scope link 
38.100.42.248/29 dev eth0  proto kernel  scope link  src 38.100.42.250 
38.105.84.192/28 dev eth0  scope link  src 38.100.42.250 
169.254.0.0/16 dev eth0  scope link 
default via 38.100.42.249 dev eth0 

[root@pyxis ~]# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
38.105.84.197   *               255.255.255.255 UH    0      0        0 venet0
38.105.84.199   *               255.255.255.255 UH    0      0        0 venet0
38.100.42.251   *               255.255.255.255 UH    0      0        0 venet0
38.100.42.252   *               255.255.255.255 UH    0      0        0 venet0
38.105.84.201   *               255.255.255.255 UH    0      0        0 venet0
38.100.42.253   *               255.255.255.255 UH    0      0        0 venet0
38.105.84.202   *               255.255.255.255 UH    0      0        0 venet0
38.100.42.254   *               255.255.255.255 UH    0      0        0 venet0
38.100.42.248   *               255.255.255.248 U     0      0        0 eth0
38.105.84.192   *               255.255.255.240 U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth0
default         38.100.42.249   0.0.0.0         UG    0      0        0 eth0

[root@pyxis ~]# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:30:48:97:E2:70  
          inet addr:38.100.42.250  Bcast:38.100.42.255  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:316748 errors:0 dropped:0 overruns:0 frame:0
          Base address:0x4000 Memory:d0100000-d0120000 

eth0:1    Link encap:Ethernet  HWaddr 00:30:48:97:E2:70  
          inet addr:38.105.84.193  Bcast:38.105.84.207  Mask:255.255.255.240
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Base address:0x4000 Memory:d0100000-d0120000 

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          UP BROADCAST POINTOPOINT RUNNING NOARP  MTU:1500  Metric:1
          RX packets:478279 errors:0 dropped:0 overruns:0 frame:0
          TX packets:301962 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:194917730 (185.8 MiB)  TX bytes:42197245 (40.2 MiB)


[Updated on: Fri, 16 May 2008 15:24]

Report message to a moderator

Re: *SOLVED* Access two subnets on two different NICs from VE with venet adapter [message #35043 is a reply to message #30218] Mon, 23 February 2009 23:19 Go to previous messageGo to next message
oeginc is currently offline  oeginc
Messages: 5
Registered: February 2009
Junior Member
kraln wrote on Fri, 16 May 2008 11:05

I think I have a similar issue.

I have two subnets assigned to me, but only one interface (and one default route). I managed to fix this once, but when I just had to reboot the machine, one of the subnets stopped working.

I have 38.100.42.248/29, HN is 38.100.42.250, 38.100.42.249 is the default gateway.

I also have 38.105.84.192/28.

When the machine came back up, the nodes in the 38.100.42.248 subnet all work but the ones in the 38.105.84.192 subnet all don't.

I don't have any iptables or such malarky running. Help?



I am having the exact same problem, have you found a solution yet? Unfortunately, this post is marked FIXED so I doubt anyone is reading it anymore...

[Updated on: Mon, 23 February 2009 23:19]

Report message to a moderator

Re: *SOLVED* Access two subnets on two different NICs from VE with venet adapter [message #35050 is a reply to message #35043] Tue, 24 February 2009 08:40 Go to previous messageGo to next message
maratrus is currently offline  maratrus
Messages: 1495
Registered: August 2007
Location: Moscow
Senior Member
Hello,

try to set
NEIGHBOUR_DEVS variable in /etc/vz/vz.conf to "all".
Re: *SOLVED* Access two subnets on two different NICs from VE with venet adapter [message #35064 is a reply to message #35050] Tue, 24 February 2009 21:56 Go to previous message
oeginc is currently offline  oeginc
Messages: 5
Registered: February 2009
Junior Member
That worked, perfect! Thank you so much!
Previous Topic: Kernel leak problems.
Next Topic: Simfs POSIX translation for VE
Goto Forum:
  


Current Time: Sat Nov 16 13:43:21 GMT 2024

Total time taken to generate the page: 0.03089 seconds