We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

Private networking

Lets think, that you have only one external IP -- $EXTIP.

And you want to have several vservers runned without think about port overlapping.

The one solution is:

So, what you doing:

1. Set up dummy0 iface on host

# /etc/network/interfaces on debian box, configure on other distros with your preferred way
auth dummy0
iface dummy0 inet static
    address 192.168.1.250
    netmask 255.255.255.0

2. Set up your vserver:

# Contents of /etc/vservers/<vserver>/interface/0/
dev: dummy0
ip: 192.168.1.1
name: 1
prefix: 24

I suggest you to use value of name equal to last digit of ip -- for easy separation

3. Now, configure firewall on server:

3.1. Enable ipv4 forwarding:

# /etc/sysctl.conf
net/ipv4/ip_forward=1

3.2. Configure firewall:

echo | iptables-restore --noflush <<EOF
*filter
:FORWARD DROP [0:0]
-A FORWARD -m state --state INVALID -j REJECT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m state --state NEW -s 192.168.1.0/24 -j ACCEPT
-A FORWARD -m state --state NEW -d 192.168.1.0/24 -j ACCEPT
COMMIT
*nat
-A POSTROUTING -s 192.168.1.0/24 -d ! 192.168.1.0/24 -j SNAT --to-source $EXTIP
COMMIT
EOF

After that, for each service that runned on vhosts local address $VHOST and port $INTPORT you select one external port $EXTPORT and map it by running

iptables -t nat -A PREROUTING -s ! 192.168.1.0/24 -m tcp -p tcp --dport $EXTPORT -j DNAT --to-destination $VHOST:$INTPORT

Thats all!

Try ping pool.ntp.org from your vserver -- it should ping fine.

Try to connect to your $EXTIP:$EXTPORT (from other server) -- you will successfully connect to service at your vserver.