OpenVZ主机是源IP地址，而不是实际的网络冲浪者？

Question

我正经历着一些奇怪的事情。我正在CentOS 5服务器上运行CentOS。看来，在容器中，表示Apache的源IP地址是来自OpenVZ主机的IP地址，而不是实际的冲浪者的IP地址。至于为何会出现这种情况，有何建议？

这是我的sysctl.conf：

# packet forwarding enabled and proxy arp disabled
net.ipv4.ip_forward = 1
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.default.proxy_arp = 0

# Enables source route verification
net.ipv4.conf.all.rp_filter = 1

# Enables the magic-sysrq key
kernel.sysrq = 1

# We do not want all our interfaces to send redirects
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0

iptables保存输出：

# Generated by iptables-save v1.3.5 on Sun Jan  3 15:23:59 2010
*nat
:PREROUTING ACCEPT [756200:49422664]
:POSTROUTING ACCEPT [903767:67426359]
:OUTPUT ACCEPT [369070:31874494]
-A POSTROUTING -m mark --mark 0x9 -j MASQUERADE 
COMMIT
# Completed on Sun Jan  3 15:23:59 2010
# Generated by iptables-save v1.3.5 on Sun Jan  3 15:23:59 2010
*mangle
:PREROUTING ACCEPT [12320704:7736523164]
:INPUT ACCEPT [384169:50094465]
:FORWARD ACCEPT [11926020:7685806944]
:OUTPUT ACCEPT [386465:36820058]
:POSTROUTING ACCEPT [12308944:7722398683]
-A PREROUTING -i eth0 -j MARK --set-mark 0x9 
COMMIT
# Completed on Sun Jan  3 15:23:59 2010
# Generated by iptables-save v1.3.5 on Sun Jan  3 15:23:59 2010
*filter
:INPUT ACCEPT [379753:49502640]
:FORWARD ACCEPT [11855492:7632198223]
:OUTPUT ACCEPT [386465:36820058]
:RH-Firewall-1-INPUT - [0:0]
COMMIT
# Completed on Sun Jan  3 15:23:59 2010

ip ro输出：

68.168.248.39 dev venet0  scope link 
68.168.248.38 dev venet0  scope link 
68.168.248.37 dev venet0  scope link 
68.168.248.36 dev venet0  scope link 
68.168.248.35 dev venet0  scope link 
68.168.248.34 dev venet0  scope link 
68.168.248.33 dev venet0  scope link 
68.168.248.40 dev venet0  scope link 
208.89.162.96/27 dev eth0  proto kernel  scope link  src 208.89.162.114 
169.254.0.0/16 dev eth0  scope link 
default via 208.89.162.97 dev eth0 

Answer 1

这一切似乎都归结为在iptable中出现了残缺。一旦它被移除，一切似乎都正常工作了。我不确定这是默认的CentOS设置还是沿途设置的东西。因此，如果您正在经历这种运行：

iptables -t nat -L
iptables -t mangle -L

确保一切都被清理干净。另外，检查以确保更改反映在/etc/sysconfig/iptables中，以便在重新启动时不会再次发生。

Answer 2

http://wiki.openvz.org/Differences_在两者之间_维尼特_和_贝斯

确保您对客人使用以太网桥接，而不是“主机级的nat”

Answer 3

你是把NAT‘’ing倒入你的容器里，还是其他奇怪的诡计？

我在工作中也看到了这一点，因为我们有基于Piranha的web负载平衡器，所以当来自公共IP的NAT请求进入我的web服务器而不是将它们暴露到Internet上时