A few questions

[Rudy]

Hello,

First, I would like to thank the proxmox's team for their great environment !

My name is rudy and I'm working at a (small) department of an university. A small part of my job is to take care of all IT in my department.

In my department, we are currently running two PC servers based on debian. The first one is mainly used for file sharing between members and as secondary website for big file sharing (for students) (our main website is running on the university server) + a small website which needs specific library. The second server is used as a DRBL (Clonezilla) server for dispatching image of 15 student's PC (+ internet access). On this server, I'm currently running virtualbox with two vm's. The first vm is a windows xp which runs a software license server (windows is mandatory). The second vm is a redmine server which was (is?) tested by a Professor for project management.

I'm currently testing proxmox 2.0 (rc) to first replace the DRBL server and I have a few questions :
- I intend to install DRBL in an openvz container (debian template) but I don't know if DRBL can be installed in a CT or I need to install it in a full virtualization environment ? (DRBL server uses tftp ...)
- The proxmox server uses three network interfaces (as the DRBL server) :
* eth0 (vmbr0) for internet access (wan) (very slow interface - 10Mbit !)
* eth1 (vmbr1) lan of department (lan1) 192.168.1.0/24 (1Gbit interface)
* eth2 (vmbr2) student's PC lan (lan2) 192.168.3.0/24 (100Mbit inteface)
The DRBL server is currently configured as internet access for lan1 but mainly for lan2. lan2 is accessible from lan1 but lan1 is not accessible from lan2 (it is defined in my iptables rules).
I would like to do the same configuration for the proxmox server but I don't know if it would be better to use a CT or directly use the proxmos server by bridging other interfaces on eth0/eth1/eth2 (because a CT would do the same result and the IP tables rules should always be available) ? Can I directly add my bridge interfaces with specific name in the /etc/network/interface file of pve since the pve interface doesn't allow to bridge with other names than vmbr ?


Sorry for this long post and I thank you by advance for your replies.

Best begards,
Rudy

PS: I'm currently learning a lot about virtualization. So, sorry, if my questions seem basic !

 

[udo]

Hi Rudy,
CTs have a small footprint and do much faster IO than kvm-VMs. But you can't add kernel-modules which aren't activate on the host (and allowed to use in the CT). I think for tftp it's not a problem, but with iptables??
But why don't use two machines? One small firewall-kvm-VM which do the routing and the DRBL as CT? Virtualisation has the afford, that you can have many VMs ;-)

BTW. I would change the bridge-order. Take vmbr0 on the fast gigabit-line and vmbr1,2 (or vmbr10 and vmbr100 - for 10mbit and 100Mbit). Because if you build an cluster you need the fast connection between the nodes (and clustercommunication is on vmbr0).

Udo

 

[Rudy]

Dear Udo,

Thank you very much for your reply !

Iptables are activated on the host but I want to avoid any problems between vm's. So I will probably use a CT or kvm-vm.
By the way, I have to check if DRBL doesn't need specific kernel-modules if I want to use in a CT (I'm not sure about this ...) I think I will try install DRBL on a CT ...

I didn't know that clustercommunication is on vmbr0. Thank you for this information. I will change the bridge order as you suggested !

If you or other people have other suggestions, they are welcome !

Kind regards,
Rudy

 

[Rudy]

Hi,

For info, iptables seems to work in a CT if you don't forget to activate iptables module in the vz config (vz.conf iptable_nat ipt_state - don't forget to install/activate these modules on the host : e.g. modprobe xn_state)
Only masquerade doesn't work in a CT, so I use SNAT ...

DRBL needs nfs server (kernel) & NIS which are not installed on the host, so I decided to use a kvm virtualization for drbl.

Regards,
Rudy