We currently migrate to MediaWiki from our old installation, but not all content has been migrated yet. Take a look at the Wiki Team page for instructions how to help or browse through our new wiki at wiki.linux-vserver.org to find the information already migrated.

Yes, it works ! :)

Be careful, this is a very dirty, rough howto. At this time, this is much more a list of hacks. Corrections always welcome by mail (kalou@kalou.net) or edit directly this page.

Goal

I am a poor linux admin, and have got only one linux box in my lab, and would like to use a real firewalling solution. I heard about IPCop, one of the best Firewall Open Source Solution at this time. So let's try to have it run inside a vserver...

Requirements

- a working vserver skel (my skel is a debian sid debootstrap)

- a link to the internet (the red interface)

- a local lan (the green interface)

- the IPCOP CD (or the ISO image of it)

Steps

FROM THE HOST VSERVER

- mkdir /vservers/ipcop
(this directory is the root of your ipcop vserver)

- debootstrap sid /vservers/ipcop
- (this magic command will create a minimal Debian vserver into /vserver/ipcop)
- mount ipcop-1.4.5.iso on /vservers/ipcop/mnt/iso (from the host vserver)

IN THE IPCOP VSERVER (vserver ipcop enter)

- ipcop:/mnt/iso# tar -zxvf ipcop-1.4.5.tgz -C /ipcop/ 2> /tmp/mknod-errors.txt
  tar will complain about /dev/ entries, because you dont have the CAP_MKNOD .

- In the host server, first create the minimal required devices to run a vserver:

drwxr-xr-x root/root         0 2005-05-12 21:46:13 ipcop/dev/pts/
crw------- root/tty      136,0 2005-05-12 21:54:24 ipcop/dev/pts/0
crw--w---- root/tty      136,1 2005-05-12 22:36:35 ipcop/dev/pts/1
crw--w---- root/tty      136,2 2005-05-12 22:36:41 ipcop/dev/pts/2
crw--w---- root/tty      136,3 2005-05-12 22:36:00 ipcop/dev/pts/3
crw-r--r-- root/root       5,0 2004-10-02 22:16:20 ipcop/dev/tty
crw-r--r-- root/root       1,7 2004-10-02 22:15:40 ipcop/dev/full
crw-rw-rw- root/root       1,3 2004-10-02 22:15:48 ipcop/dev/null
crw-r--r-- root/root       5,2 2004-10-02 22:16:01 ipcop/dev/ptmx
crw-r--r-- root/root       1,5 2004-10-02 22:16:36 ipcop/dev/zero
lrwxrwxrwx root/root         0 2005-04-18 10:46:12 ipcop/dev/MAKEDEV -> /sbin/MAKEDEV
prw-r----- root/adm          0 2004-12-26 11:11:19 ipcop/dev/xconsole
crw-r--r-- root/root       1,8 2004-10-02 22:16:09 ipcop/dev/random
crw-r--r-- root/root       1,9 2004-12-17 21:13:51 ipcop/dev/urandom

Then, among the following devices, choose and create the ones that you might need (Here I have no isdn, nor do I need the ipsec, ipnat and ip* stuff. You might need them)

ipcop:/mnt/iso# grep mknod /tmp/mknod-errors.txt | egrep -v "tty|usb|nst|capi|raid|scd|/st|/sd|/hd|/ram|/fd|/lp|/rd|/parport|/sg|/isdn|/ccis|/ida|/loop|/zero|/dc|/ps" 

Now, let's modify the apache and sshd configuration laying \
into /ipcop (from inside the vserver), to suit the configuration \
of your vserver (my IPROOT is 192.168.25.1)

ipcop:/# grep ListenAdd /etc/ssh/sshd_config 
ListenAddress 192.168.25.1


(change the documentroot in /etc/apache/httpd.conf to:
DocumentRoot /ipcop/home/httpd/html

ipcop:/# grep BindAddress /etc/apache/httpd.conf 
BindAddress 192.168.25.1

ipcop:/ipcop# cat var/ipcop/main/hostname.conf
ServerName 192.168.25.1

Now, create the right script to have your vserver start the ipcop service from inside a chroot: /usr/sbin/chroot /ipcop/ httpd &

Installing IPCop on windows:

http://ipcop.org/modules.php?op=modload&name=FAQ&file=index&myfaq=yes&id_cat=3#q26