1

I've installed SolusVM as a Master server that will host OpenVZ containers on a fresh install of CentOS 6.6

What i am now noticing is that if i traceroute one of my containers IP addresses i see the host node's IP address as the hop right before the containers IP.

Example:

6     39      45      49         1.2.3.4      -  
7     38      39      39         1.1.1.1     hostnode.com  <===== HostNode
8     38      38      38         2.2.2.2     container.com  <===== OpenVZ Container

What i want to know is there any way i can stop the host node from appearing in traceroutes ?

I know i can set "net.ipv4.conf.icmp_echo_ignore_all = 1" in "/etc/sysctl.conf" but it is my understanding that this will only stop ping responses and not traceroutes.

I'm primarily concerned about an attacker being able to see and DDOS my Host Node IP which would cause all containers to go offline. My ISP will nullroute any IPs that gets attacked and while having a single containers IP null routed is not a huge deal i need to make sure that my host node does not get attacked to cause downtime on all containers.

My desired outcome would be either my host node not appearing in the traceroute at all or just timeout completely, i just need a point in the right direction.

1 Answer 1

1

The traffic from your VMs to the public internet must be routed through the interface of the host node so there is no way to completely remove the parent node as a hop in the traceroute results.

However, you can use iptables on the parent node to block outbound ICMP packets. This will hide the IP address of your parent node in the traceroute results -- appearing only as request timed out in the traceroute results.

Run these commands as root on your OpenVZ node:

iptables -A OUTPUT -p icmp  --icmp-type 0 -j DROP
iptables -A OUTPUT -p icmp  --icmp-type 8 -j DROP
iptables -A OUTPUT -p icmp  --icmp-type 11 -j DROP
iptables -A OUTPUT -p icmp  --icmp-type 30 -j DROP
1
  • That's perfect, got the exact results i wanted. Thanks!
    – Analog
    Jun 24, 2015 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .