Guido, thanks for the reply.
Guido Jäkel wrote:
> if your separate networks are already organized with VLANs externally,
> then you might use it (like me) in the following way:
>
> -{vlan-trunk}--[eth0]--+--[vlaNNN]--{vlanNNN}--[brNNN]--+--[veth.c1|eth0]
> | +--[veth.c2|eth0]
> +--[vlanMMM]--....
>
> On your host, attach vlan adapters to the physical interface. This
> will switch the into promicuous mode (L2-Mode) and needs not IP (L3)
> configuration. Each vlan interfaces will untrunk one vlan. Then
> connect bridges to this vlan interfaces. Also, as the bridge is a L2
> device, it needs no IP configuration. But you may use the bridge's IP
> configuration parameters to access this net on the host; think it as
> an additional virtual network card which is already connected to the
> bridge. But normaly, you dont't wont that and use an additional vlan
> here. Attach an additional vlan adapter to the eth0 for this and
> assign the hosts IP config to it.
That's where I was headed.
I already use VLANs at the switch with PVIDs, as a security mechanism to
separate traffic: between the firewall and each internal computer, from
all other internal computers. So the original configuration was:
+-------------------------------+
|+----+ |
|| |------------+ c1 |
|| c1 | eth0/.17.3 |---\ |
|| |------------+ +-----+ |------------+
|+----+ | br1 |---| eth1/.17.2 |-----
|+----+ +-----+ |------------+
|| |------------+ | |
|| c2 | eth0/.17.4 |---/ |
|| |------------+ c2 |
|+----+ |
+-------------------------------+
with all the traffic going through the switch on VLAN 17. So that
became:
+------------------------------------------------+
|+----+ |
|| |------------+ c1 |
|| c1 | eth0/.17.3 |---\ |
|| |------------+ +--------+ +---------+ |------------+
|+----+ | br1.17 |---| eth1.17 |---| eth1/.17.2 |-----
|+----+ +--------+ +---------+ |------------+
|| |------------+ | |
|| c2 | eth0/.17.4 |---/ |
|| |------------+ c2 |
|+----+ |
+------------------------------------------------+
dropping the PVID from the switch. But when I added another VLAN:
+------------------------------------------------+
|+----+ |
|| |------------+ c1 |
|| c1 | eth0/.17.3 |---\ |
|| |------------+ +--------+ +---------+ |------------+
|+----+ | br1.17 |---| eth1.17 |---| eth1/.17.2 |-----
|+----+ +--------+ +---------+ | |------------+
|| |------------+ | | |
|| c2 | eth0/.17.4 |---/ | |
|| |------------+ c2 | |
|+----+ | |
| +--------+ +---------+ | |
| | br1.18 |---| eth1.18 |-/ |
| +--------+ +---------+ |
+------------------------------------------------+
with
---------------------------------------------
iface eth1.18 inet manual
auto br1.18
iface br1.18 inet static
bridge_ports eth1.18
bridge_maxwait 0
bridge_fd 0
bridge_stp off
address 192.168.18.2
netmask 255.255.255.0
gateway 192.168.18.1
dns...
iface eth1.17 inet manual
auto br1.17
iface br1.17 inet static
bridge_ports eth1.17
bridge_maxwait 0
bridge_fd 0
bridge_stp off
address 192.168.17.2
netmask 255.255.255.0
gateway 192.168.17.1
dns...
---------------------------------------------
in /etc/network/interfaces, I got two default routes:
---------------------------------------------
host$ ip route show
192.168.18.0/24 dev br1.18 proto kernel scope link src 192.168.18.2
192.168.17.0/24 dev br1.17 proto kernel scope link src 192.168.17.2
default via 192.168.17.1 dev br1.17
default via 192.168.18.1 dev br1.18
---------------------------------------------
I'm curious how you configured yours.
> On the host's route, you need to switch the port for the host to
> trunked vlan mode as if you will interconnect switches. And you should
> prune the vlan trunk to the vlans you need to reduce the (broadcast)
> traffic to the hosts interface.
I removed the PVID on the switch port, and placed the port into VLANs 17
& 18. Something I need to do on the host, too? Not sure what
configuration you're referring to there.
> But you may also do it without using vlans and may good-old subnets
> for separation. Then, just connect one bridge to the eth0 of the host
> and also attach the veths of the containers to it. Here you probably
> want to assign an IP to the bridge for accessing host. Note that the
> access to the subnet here is "selected" only by the IP configuration
> inside the container.
I assume by "IP configuration" you mean "iptables configuration".
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________
Lxc-users mailing list
Lxc-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/lxc-users
