OpenVZ veth0 vs eth0

[Lantizia]

Hey,

I run the Untangle firewall as a Kernel-based Virtual Machine with two virtual NIC's, it's LAN side interface eth0 is connected to vmbr0 and it's WAN side eth1 to vmbr1. In turn vmbr0 is connected to the hosts physical eth0 port to other LAN side physical equipment and vmbr1 is connected to my WAN uplink. Simply put whatever0 is always LAN side and whatever1 is always WAN side. This set-up means all my other KVM and OpenVZ virtual machines have to go through the Untangle firewall to get out on the Internet as they're set to bridge mode using vmbr0.

So be it a KVM or OpenVZ virtual machine the situation is always...
Guest eth0 -> vmbr0 -> Firewall eth0 -> Firewall eth1 -> vmbr1 -> Hosts eth1 -> Internet

Or if it is a Physical machine...
Physical eth0 -> Hosts eth0 -> vmbr0 -> Firewall eth0 -> Firewall eth1 -> vmbr1 -> Hosts eth1 -> Internet

Before I put my problem, here is something I've also observed...

The Debian OpenVZ containers I'm making set to vmbr0 (and thus get an eth0 interface) don't have an eth0 interface in /etc/network/interfaces automatically, now obviously because it's bridged Proxmox VE doesn't know what to write like it would with veth0. However I feel a sample eth0 section might be worth putting here for future versions, at the very least Proxmox VE can guess the dns-search and dns-nameservers information.

Now for the real problem...

If you set vmbr0 (and thus get an eth0 interface) on an OpenVZ container you can still see veth0. I don't think there's anything to worry about if venet0 got accidentally configured and used instead as the Promox VE host sits on vmbr0 too and thus behind the virtual Untangle firewall as well.

I'd rather the OpenVZ containers use eth0 than venet0 as some crap installs demand an eth0 present, and I'd like venet0 to be hidden (this should be default if you've selected bridge mode) so that only one can be used and also so both don't show up in things like web hosting control panels.

So am I right in saying for my set-up there's no harm in using venet0 even if it does show up, and is there a way of disabling/hiding venet0 when in bridge mode?

Thanks

Steven

 

[Nemesiz]

You can`t hide vethx in Host side. VPS eth0 and Host vethx are linked as one.

 

[Lantizia]

You can`t hide vethx in Host side. VPS eth0 and Host vethx are linked as one.

I'm not trying to hide it host side, trying to hide it guest side.

 

[Nemesiz]

Are you talking about venet?

 

[Lantizia]

Sorry yes, for every instance I have mentioned veth0 I have actually meant venet0 that you can see when running this inside the guest...

ifconfig -a

But I'm questioning why it is there when the container is on bridged mode, so you should just see eth0 not both...

p.s. I will update my original post to clarify!

 

[Nemesiz]

http://wiki.openvz.org/Disable_venet_interface

It will disappear in all OpenVZ vps as i remember.

p.s. don't forget to look at http://wiki.openvz.org/Differences_between_venet_and_veth

 

[Lantizia]

OK so is eth0 and veth0 the same thing... it's just named eth0 inside the container?

As for venet0, I'd prefer it to not show if you've chosen to not use it on a particular container... not disable it globally.

Can you confirm there isn't any harm in using venet0 even if bridged mode is on and it would still go via my firewall to get out on the internet as Proxmox host itself sits on an internal IP and has to go out via the firewall to get Internet access (as described above).

 

[Nemesiz]

Yes, you can ignore venet

 

[Lantizia]

Yes, you can ignore venet

I'm not sure which question that is answering, but it doesn't seem to answer any of them.

 

[Nemesiz]

You want to use veth or both veth and venet? venet will go straight to internet (if MASQUERADE is on).

p.s. OpenVZ vps cant see is it using bridge or not.

 

[Lantizia]

OK my understanding has improved alot...

However venet can't go straight to the Internet any more than veth can on my set up, as the host itself is behind the firewall that is only reachable via veth.

When selecting venet mode I don't want eth0 showing guest side using ifconfig -a
And it doesn't

When selecting veth mode I don't want venet0 showing guest side using ifconfig -a
But it does

It's that simple...

 

[Lantizia]

*Bump*

Anyone got an answer for the fact that when you select veth mode, venet0 still shows up inside the guest machine when using ifconfig -a ???

Also, it would be handy if when you select veth mode it at least writes an entry for eth0 in the /etc/network/interfaces file - can I file a feature request for this? is there a bug tracker?

 

[dietmar]

Also, it would be handy if when you select veth mode it at least writes an entry for eth0 in the /etc/network/interfaces file - can I file a feature request for this? is there a bug tracker?

This is OpenVZ related: http://bugzilla.openvz.org/

 

[Lantizia]

Anyone got an answer for the fact that when you select veth mode, venet0 still shows up inside the guest machine when using ifconfig -a ???

And how about this nugget? is this for their bugtracker too?

Does Proxmox VE even have one?

 

[dietmar]

And how about this nugget? is this for their bugtracker too?

yes (although i am not sure if this is a bug).

Does Proxmox VE even have one?

Yes, but only accessible for active developers.