Help! Question about networking: Can container with private IP connect to each other?

[zbrandom]

Hi all,

I'm trying to set up a test server using promox VE. The host have a Internet IP, and all the containers use private IPs. But it seems to me that containers can't connect to each other, why? Did I do the configuration wrong?

My plan is to use DNAT to redirect traffic to port 80 of the host to one container running NGINX, and the NGINX fetch data from another container that is running Squid, and squid get all the data from another container that has Apache2. Is it doable?

I am new to virtualization, but I find it amazing. Please help me to figure out what is wrong. Thanks.

 

[dietmar]

I'm trying to set up a test server using promox VE. The host have a Internet IP, and all the containers use private IPs. But it seems to me that containers can't connect to each other, why? Did I do the configuration wrong?

You are using openvz containers with virtual ethernet (venet)?

I just tested that, and it work here. To test the connection i use:

# ping  IPADDRESS

Maybe you used DNS names and DNS is not working because you use private IPs?

My plan is to use DNAT to redirect traffic to port 80 of the host to one container running NGINX, and the NGINX fetch data from another container that is running Squid, and squid get all the data from another container that has Apache2. Is it doable?

Why not? Although setting up DNAT needs manual iptables configuration.

- Dietmar

 

[dietmar]

My plan is to use DNAT to redirect traffic...

It is recommended to run Proxmox VE behind a firewall, so that you can do all that DNAT things on the firewall.

- Dietmar

 

[zbrandom]

Yes, I am using OpenVZ with venet. I have just tried to ping after reading your reply, it worked. But I have spent a few hours trying to get NGINX work. maybe it is because of my configuration. I'll try that later.

There is a workaround that I came up with, which is installing NGINX on the host. I think NGINX is robust enough so it will not greatly hurt the reliability of the host. And Squeeze squid and apache in a container. But I don't think that satisfying.

 

[zbrandom]

It is definitely more secure running it after a firewall, but I am thinking of installing Shorewall on the host to take care of the firewall and stuff, what do you think about the idea? I guess iptables/netfilter is strong enough, but I don't have experience tweaking it. Any suggestion?

 

[dietmar]

I tested shorewall a few weeks ago - works without problems.

- Dietmar

 

[zbrandom]

Thanks for your all, dietmar!
I reconfigured the environment, and it turned out that containers can connect to each other without problem! Proxmox is great!