holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Add some info about mis-using Vserver zones

Browse Source
This commit is contained in:
Tom Eastep 2011-01-23 09:43:35 -08:00
parent 82913abeca
commit a7dd95d394
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
docs/Shorewall_and_Aliased_Interfaces.xml
View File

@ -338,5 +338,15 @@ loc2 eth1:192.168.20.0/24</programlisting>
Interface</emphasis></ulink>.</para>
</example>
</section>
<section>
<title>Defining a Zone-per-Address</title>
<para><ulink url="Vserver.html">Shorewall's support for Linux
Vservers</ulink> can (miss-)used to create a separate zone per alias.
Note that this results in a <emphasis>partitioning of the firewall
zone</emphasis>. Be sure that you define an ACCEPT policy between your
vserver zones and $FW.</para>
</section>
</section>
</article>

5
docs/Vserver.xml
View File

@ -65,6 +65,11 @@
</listitem>
</itemizedlist>
<para>Note that you don't need to run Vservers to use vserver zones; they
may also be used to create a firewall sub-zone for each <ulink
url="Shorewall_and_Aliased_Interfaces.html">aliased
interface</ulink>.</para>
<para>If you use these zones, keep in mind that Linux-vserver implements a
very weak form of network virtualization:</para>