7
edits
Changes
→Private VEs (not directly visible from the LAN)
== Private VEs (not directly visible from the LAN) ==
When starting with a new VE that should not be directly visible on the LAN it is important to choose an appropriate IP address. By running "ifconfig -a" on the host it is possible to see all the networks the host is connected to. The VE should reside on a a new private network, choosing one of the 192.168.X.Y/24 subnets is a good choice. For example, on a host which is already on a 192.168.1.0/24 subnet then the 192.168.2.0/24 subnet would be a reasonable choice (unless the host is already on that subnet too). In these examples the host has eth0 with address 192.168.1.53, and 192.168.2.0/24 is free so we will give the VE 192.168.2.1. The VE (101) is assumed to be freshly created and started, with no networking currently set up. === Venet === Venet routed networking is probably the simplest to set up, simply add the IP address to the VE: <pre>[host-node]# vzctl set 101 --ipadd 192.168.2.1 --save</pre> After this the host should be able to ping the VE. To allow the VE to access the rest of the LAN we must enable forwarding and masquerading, as all activity on the LAN must look like it is coming directly from host (with its IP address). <pre>[host-node]# echo 1 > /proc/sys/net/ipv4/ip_forward[host-node]# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE</pre> === Veth === This is a stub.
== Public VEs (with their own IP addresses) ==