shorewall_code/docs/Vserver.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
<article>
  <!--$Id$-->

  <articleinfo>
    <title>Shorewall and Linux-vserver</title>

    <authorgroup>
      <author>
        <firstname>Tom</firstname>

        <surname>Eastep</surname>
      </author>
    </authorgroup>

    <pubdate><?dbtimestamp format="Y/m/d"?></pubdate>

    <copyright>
      <year>2010</year>

      <holder>Thomas M. Eastep</holder>
    </copyright>

    <legalnotice>
      <para>Permission is granted to copy, distribute and/or modify this
      document under the terms of the GNU Free Documentation License, Version
      1.2 or any later version published by the Free Software Foundation; with
      no Invariant Sections, no Front-Cover Texts, and no Back-Cover
      Texts. A copy of the license is included in the section entitled
      <quote><ulink url="GnuCopyright.htm">GNU Free Documentation
      License</ulink></quote>.</para>
    </legalnotice>
  </articleinfo>

  <section>
    <title>Introduction</title>

    <para>Formal support for Linux-vserver was added in Shorewall 4.4.11
    Beta2. The centerpiece of that support is the
    <firstterm>vserver</firstterm> zone type. Vserver zones have the following
    characteristics:</para>

    <itemizedlist>
      <listitem>
        <para>They are defined on the Linux-vserver host.</para>
      </listitem>

      <listitem>
        <para>The $FW zone is their implicit parent.</para>
      </listitem>

      <listitem>
        <para>Their contents must be defined using the <ulink
        url="manpages/shorewall-hosts.html">shorewall-hosts </ulink>(5) file.
        The <emphasis role="bold">ipsec</emphasis> option may not be
        specified.</para>
      </listitem>

      <listitem>
        <para>They may not appear in the ZONE column of the <ulink
        url="manpages/shorewall-interfaces.html">shorewall-interfaces</ulink>
        (5) file.</para>
      </listitem>
    </itemizedlist>

    <para>Note that you don't need to run Vservers to use vserver zones; they
    may also be used to create a firewall sub-zone for each <ulink
    url="Shorewall_and_Aliased_Interfaces.html">aliased
    interface</ulink>.</para>

    <para>If you use these zones, keep in mind that Linux-vserver implements a
    very weak form of network virtualization:</para>

    <itemizedlist>
      <listitem>
        <para>From a networking point of view, vservers live on the host
        system. So if you don't use care, Vserver traffic to/from zone z will
        be controlled by the fw-&gt;z and z-&gt;fw rules and policies rather
        than by vserver-&gt;z and z-&gt;vserver rules and policies.</para>
      </listitem>

      <listitem>
        <para>Outgoing connections from a vserver will not use the Vserver's
        address as the SOURCE IP address unless you configure applications
        running in the Vserver properly. This is especially true for IPv6
        applications. Such connections will appear to come from the $FW zone
        rather than the intended Vserver zone.</para>
      </listitem>

      <listitem>
        <para>While you can define the vservers to be associated with the
        network interface where their IP addresses are added at vserver
        startup time, Shorewall internally associates all vservers with the
        loopback interface (<emphasis role="bold">lo</emphasis>). Here's an
        example of how that association can show up:</para>

        <programlisting>gateway:~# shorewall show zones
Shorewall 4.4.11-Beta2 Zones at gateway - Fri Jul  2 12:26:30 PDT 2010

fw (firewall)
drct (ipv4)
   eth4:+drct_eth4
loc (ipv4)
   eth4:0.0.0.0/0
net (ipv4)
   eth1:0.0.0.0/0
vpn (ipv4)
   tun+:0.0.0.0/0
dmz (<emphasis role="bold">vserver</emphasis>)
   <emphasis role="bold">lo</emphasis>:70.90.191.124/31

gateway:~#</programlisting>
      </listitem>
    </itemizedlist>
  </section>

  <section>
    <title>Vserver Zones</title>

    <para>This is a diagram of the network configuration here at Shorewall.net
    during the summer of 2010:</para>

    <graphic align="center" fileref="images/Network2010a.png"/>

    <para>I created a zone for the vservers as follows:</para>

    <para><filename>/etc/shorewall/zones</filename>:</para>

    <programlisting>#ZONE           TYPE            OPTIONS            ...
fw              firewall
loc             ip              #Local Zone
drct:loc        ipv4            #Direct internet access
net             ipv4            #Internet
vpn             ipv4            #OpenVPN clients
<emphasis role="bold">dmz             vserver         #Vservers</emphasis></programlisting>

    <para><filename>/etc/shorewall/interfaces</filename>:</para>

    <programlisting>?FORMAT 2
#ZONE   INTERFACE     OPTIONS
<emphasis role="bold">net     eth1          routeback,dhcp,optional,routefilter=0,logmartians,proxyarp=0,nosmurfs,upnp</emphasis>
...</programlisting>

    <para><filename>/etc/shorewall/hosts</filename>:</para>

    <programlisting>#ZONE   HOST(S)                                 OPTIONS
drct    eth4:dynamic
<emphasis role="bold">dmz     eth1:70.90.191.124/31                   routeback</emphasis></programlisting>

    <para>While the IP addresses 70.90.191.124 and 70.90.191.125 are
    configured on eth1, the actual interface name is irrelevant so long as the
    interface is defined in <ulink
    url="manpages/shorewall-interfaces.html">shorewall-interfaces</ulink> (5).
    Shorewall will consider all vserver zones to be associated with the
    loopback interface (<emphasis role="bold">lo</emphasis>). Note that the
    <emphasis role="bold">routeback</emphasis> option is required if the
    vservers are to be able to communicate with each other.</para>

    <para>Once a vserver zone is defined, it can be used like any other zone
    type.</para>

    <para>Here is the corresponding IPv6 configuration.</para>

    <para><filename>/etc/shorewall6/zones</filename></para>

    <programlisting>#ZONE	TYPE	OPTIONS			IN_OPTIONS			OUT_OPTIONS
fw	firewall
net	ipv6
loc	ipv6
vpn	ipv6
<emphasis role="bold">dmz	vserver</emphasis>
</programlisting>

    <para><filename>/etc/shorewall6/interfaces</filename>:</para>

    <programlisting>?FORMAT 2
#ZONE   INTERFACE     OPTIONS
<emphasis role="bold">net     sit1          tcpflags,forward=1,nosmurfs,routeback</emphasis>
...</programlisting>

    <para><filename>/etc/shorewall6/hosts</filename>:</para>

    <programlisting>#ZONE   HOST(S)                                 OPTIONS
<emphasis role="bold">dmz     sit1:[2001:470:e857:1::/64]</emphasis></programlisting>

    <para>Note that I choose to place the Vservers on sit1 (the IPv6 net
    interface) rather than on eth1. Again, it really doesn't matter
    much.</para>
  </section>

  <section id="NDP">
    <title>Sharing an IPv6 /64 between Vservers and a LAN</title>

    <para>I have both a /64 (2001:470:b:227::/64) and a /48
    (2001:470:e857::/48) from <ulink
    url="http://www.tunnelbroker.net">Hurricane Electric</ulink>. When I first
    set up my Vserver configuration, I assigned addresses from the /48 to the
    Vservers as shown above.</para>

    <para>Given that it is likely that when native IPv6 is available from my
    ISP, I will only be able to afford a single /64, in February 2011 I
    decided to migrate my vservers to the /64. This was possible because of
    Proxy NDP support in Shorewall 4.4.16 and later. The new network diagram
    is as shown below:</para>

    <graphic align="center" fileref="images/Network2011.png"/>

    <para>This change was accompanied by the following additions to
    <filename>/etc/shorewall6/proxyndp</filename>:</para>

    <programlisting>#ADDRESS		INTERFACE	EXTERNAL	HAVEROUTE	PERSISTENT
2001:470:b:227::2	-		eth4		Yes		Yes
2001:470:b:227::3	-		eth4		Yes		Yes
</programlisting>

    <para>These two entries allow the firewall to respond to NDP requests for
    the two Vserver IPv6 addresses received on interface eth4.</para>

    <para>As part of this change, the <emphasis role="bold">Lists</emphasis>
    vserver (OpenSuSE 10.3 was retired in favor of <emphasis
    role="bold">Mail</emphasis> (Debian Squeeze).</para>
  </section>
</article>