Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Problem:

I´m planning to set up several virtualized centos, rhel or ubuntu guest machines on a single centos host server (most likely using KVM). Each guest VM is running an instance of a webapp + some other services/protocols, and each guest VM needs to be reachable from outside the host, on any open port, as if each of them was a separate, DNSed box.

I´m (apparently) weak in networking tech/config, so I am simply trying to find the first edges of this problem ie. the main approaches I need to look into to get a foothold on this. Networking config "pseudocode" if you will. :)

Example:

Let´s say I own the domain foo.com.

I have a physical CentOS machine DNSed as guests.foo.com.

On this physical host machine I've got three VMs running. I want the guest VMs to be reachable as 1.guests.foo.com, 2.guests.foo.com and 3.guests.foo.com. The guest VMs run centos, rhel and ubuntu distros.

Each VM needs to respond to any (locally open) port, not just http traffic, but also ssh connections and git: protocol operations.

Where do I start, what is the most elegant approach? What, roughly, does the host and guests each, minimally, need set up for this to work well?

Note:

I´ll update the question text + comments as I learn more.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Unless you have at least 1 public IP per VM you can not have them respond on "any" open port (meaning you will need to NAT requests coming to particular ports on your host systems public IP to the internal IP of the VM). Lets say you have only 1 public IP eg. 2.3.4.5 and that is configured on the host. Now you can redirect requests coming to port 80 to 1 VM and requests coming to 443 to another VM and requests comming to any other port to any VM of your choice, but all in all you will be distributing the 65530 usable ports on the IP and routing them to your VMs, so any particular VM can't be listening on a port which another VM is listening on.

And if you do have multiple public IPs (at least 1 per VM) you can just create the DNS records for the VMs IPs.

In the multiple IP setup you should have a small public subnet like 2.3.4.0/28 for example. This network contains the following usable IPs:

  1. 2.3.4.1
  2. 2.3.4.2
  3. 2.3.4.3
  4. 2.3.4.4
  5. 2.3.4.5
  6. 2.3.4.6

2.3.4.0 is the network IP and is not usable and 2.3.4.7 is the broadcast IP for the network. Now in this approach normally the first IP (2.3.4.1) is used as the gateway for the rest your subnetwork ie. your ISP or DataCenter puts a route for 2.3.4.0/8 with 2.3.4.1 as the next hop in their firewall/router. Now all requests coming from the internet towards any IP in 2.3.4.0/8 come to the machine having the IP 2.3.4.1. So the logical thing to do would be to have this IP on your host machine.

Now you can follow two approaches:

  1. Bridge the VM machines network interfaces to the Host Machines interface having the IP 2.3.4.1 and give the VMs the IPs 2.3.4.2, 3 and 4 on their bridged interfaces.

  2. Have a host only network on the VMs eg. 192.168.10.0/24 with the IP 192.168.10.1 on the hosts virtual interface and 192.168.10.2-4 on the VM's interfaces. And then you can just NAT requests coming to 2.3.4.X to 192.168.10.X.

In both these cases the DNS records you will need will be like follows:

1.guests.foo.com 2.3.4.2 2.guests.foo.com 2.3.4.3 3.guests.foo.com 2.3.4.4 etc.

Hope this sheds some light on the issue.

share|improve this answer
    
Gotcha, so since all the VMs are sharing the same ports they cannot simply be port forward but need to be bridged to separate IP adresses. This helped things click for me, thanks! –  thomanil Aug 14 '12 at 20:07
    
Keep in mind that the bridging technique is unconventional and not reccommended. The best way to go is described in point number 2. And either way both techniques require separate IPs for each VM. Happy Hunting. –  Fahad Yousuf Aug 14 '12 at 20:20

Hostnames can point anywhere. It's unique global IP addresses for each VM that you need. (Make sure you actually have them; they can be very hard to get in some parts of the world.) Each virtual machine will require its own IP address, and if you want to reach them from the Internet, they must be global addresses.

The easiest way to do this is to use bridged networking for the VMs. How you set this up depends mostly on outside factors, such as whether you're installing a VM control panel, but this howto will give you the basic steps to set up a bridge on your local machine so you can begin testing and become more familiar with how everything works.

share|improve this answer
    
So in other words, using subdomains to route to each VM via the host system is a complete non-starter? –  thomanil Aug 14 '12 at 19:46
    
You don't reach a machine through a host name, you reach it through its IP address. The thing is, that the hostname is translated to an IP address for you (by DNS, your hosts file, whatever). –  Michael Hampton Aug 14 '12 at 19:48
    
Ahh right. So any subdomain resolution doesn't happen until I've actually gotten to the host system. Once there Apache virtual hosts can take care of the http part of the equation but other traffic like ssh: and git: has no where else to go but the actual port they've already hit on the host machine. –  thomanil Aug 14 '12 at 19:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.