Hey everyone,
this setup runs in a datacenter on a public IP 37.x.x.86/26.
The server has got one physical interface eth0.
The current setup works nicely with a masqueraded private subnet 10.10.10.0/24 and the single public IP.
I now bought two additional IP adresses, because i need public IPs for one of our services.
I could get MAC-adresses for these additional IPs as well if needed.
My question would be, how to add the new public IPs (37.x.x.85 and 37.x.x.84) to the existing setup in the most simple way.
As this is a production machine with many running containers, I would prefer to not change too much of the working setup.
What would be your suggestions?
Thank you very much!
wowo
this setup runs in a datacenter on a public IP 37.x.x.86/26.
The server has got one physical interface eth0.
The current setup works nicely with a masqueraded private subnet 10.10.10.0/24 and the single public IP.
I now bought two additional IP adresses, because i need public IPs for one of our services.
I could get MAC-adresses for these additional IPs as well if needed.
My question would be, how to add the new public IPs (37.x.x.85 and 37.x.x.84) to the existing setup in the most simple way.
As this is a production machine with many running containers, I would prefer to not change too much of the working setup.
What would be your suggestions?
Thank you very much!
wowo
Code:
# /etc/network/interfaces
auto lo
iface lo inet loopback
# Physical interface
auto eth0
iface eth0 inet static
address 37.x.x.86/26
gateway 37.x.x.1
# Del old iptables
post-up iptables -F
post-up iptables -t raw -F
post-up iptables -t nat -F
# Set defaults
post-up iptables -P FORWARD ACCEPT
post-up iptables -P INPUT DROP
post-up iptables -P OUTPUT ACCEPT
# Allow lo
post-up iptables -A INPUT -i lo -j ACCEPT
post up iptables -A OUTPUT -o lo -j ACCEPT
# Allow contrack
post-up iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
post-up iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
# Allow access to services on host
post-up iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
# more ports snipped for better readability
#Portmappings for Containers in subnet 10.10.10.0/24
post-up iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 12345 -j DNAT --to-destination 10.10.10.3:12345
#more portmappings snipped for better readability
#Bridge for the private 10.10.10.0/24 subnet
auto vmbr0
iface vmbr0 inet static
address 10.10.10.100/24
bridge-ports none
bridge-stp off
bridge-fd 0
#Masquerading for the private subnet
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o eth0 -j MASQUERADE
post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
Last edited:
