* [9fans] Speaking of routing....
@ 2003-02-13 16:52 Dan Cross
2003-02-13 17:03 ` andrey mirtchovski
2003-02-13 17:13 ` Skip Tavakkolian
0 siblings, 2 replies; 22+ messages in thread
From: Dan Cross @ 2003-02-13 16:52 UTC (permalink / raw)
To: 9fans
I have a question. I have have a CPU server with two interfaces, one
mounted on /net, the other on /net.alt. They're connected to two
networks; on internal, and the other the Internet. I want users who
login to the CPU server to be able to connect to either network
seamlessly; without jumping through hoops. Is that possible? (I know
this question is sort of vague, and I apologize for that, but I'm
pressed for time at the moment).
That is, when they connect somewhere, they shouldn't have to say,
``telnet /net.alt/tcp!foobar''; ``telnet tcp!foobar'' should work
for hosts internal and external. Is that possible? I'm afraid I
haven't looked at the code, as the machine is currently powered down,
and my laptop's battery is dead, and the charger is at home. :-(
- Dan C.
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-13 16:52 [9fans] Speaking of routing Dan Cross
@ 2003-02-13 17:03 ` andrey mirtchovski
2003-02-13 17:13 ` Skip Tavakkolian
1 sibling, 0 replies; 22+ messages in thread
From: andrey mirtchovski @ 2003-02-13 17:03 UTC (permalink / raw)
To: 9fans
there is a similar setup to yours at acl.lanl:
(web page doesn't seem to be working currently, so here's google's cache)
http://216.239.57.100/search?q=cache:ddDZwvPb2uUC:www.acl.lanl.gov/plan9/newnetwork/+&hl=en&ie=UTF-8
normally to access external machine i'd open a rio window and bind
/net.alt to /net in it, then leave it alone and use it when the need
arises -- just another beautiful example of private namespaces...
here are some samples taken from the web site above:
-------
This is the only machine that lives on the external network. The secondary
network interface is hooked to the external network the primary interface
is connected to the unrouted network. However all hosts on the internal
network can access the external network by using the command:
import plan9 /net.alt
and then using addresses like:
ping /net.alt/icmp!acl.lanl.gov
ssh /net.alt/tcp!acl.lanl.gov
Actually if you are willing to wait 30 seconds or so for the timeout you
don't need to use the /net.alt/ prefix. Or if you only want to use the
external interface in a given namespace you can import the external
interface on top of the internal interface, and the use "normal"
addresses:
import plan9 /net.alt
import plan9 /net.alt /net orbind /net.alt /net
Which is the method we commonly use.
andrey
On Thu, 13 Feb 2003, Dan Cross wrote:
> I have a question. I have have a CPU server with two interfaces, one
> mounted on /net, the other on /net.alt. They're connected to two
> networks; on internal, and the other the Internet. I want users who
> login to the CPU server to be able to connect to either network
> seamlessly; without jumping through hoops. Is that possible? (I know
> this question is sort of vague, and I apologize for that, but I'm
> pressed for time at the moment).
>
> That is, when they connect somewhere, they shouldn't have to say,
> ``telnet /net.alt/tcp!foobar''; ``telnet tcp!foobar'' should work
> for hosts internal and external. Is that possible? I'm afraid I
> haven't looked at the code, as the machine is currently powered down,
> and my laptop's battery is dead, and the charger is at home. :-(
>
> - Dan C.
>
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-13 16:52 [9fans] Speaking of routing Dan Cross
2003-02-13 17:03 ` andrey mirtchovski
@ 2003-02-13 17:13 ` Skip Tavakkolian
1 sibling, 0 replies; 22+ messages in thread
From: Skip Tavakkolian @ 2003-02-13 17:13 UTC (permalink / raw)
To: 9fans
> That is, when they connect somewhere, they shouldn't have to say,
> ``telnet /net.alt/tcp!foobar''; ``telnet tcp!foobar'' should work
> for hosts internal and external. Is that possible?
Wouldn't selectively binding /net.alt before /net do it?
^ permalink raw reply [flat|nested] 22+ messages in thread
[parent not found: <20030213095533.L50666@ >]
* Re: [9fans] Speaking of routing....
[not found] <20030213095533.L50666@ >
@ 2003-02-13 22:16 ` Dan Cross
2003-02-13 22:24 ` andrey mirtchovski
0 siblings, 1 reply; 22+ messages in thread
From: Dan Cross @ 2003-02-13 22:16 UTC (permalink / raw)
To: 9fans
Thanks, Skip and Andrey,
Unfortunately, I was hoping to avoid any mucking with namespaces,
particularly for automated things (like outgoing mail). Alas, it
seems impossible. Maybe I should go back to running both interfaces
on the same IP stack. Hmm....
- Dan C.
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [9fans] Speaking of routing....
2003-02-13 22:16 ` Dan Cross
@ 2003-02-13 22:24 ` andrey mirtchovski
2003-02-13 22:27 ` David Gordon Hogan
0 siblings, 1 reply; 22+ messages in thread
From: andrey mirtchovski @ 2003-02-13 22:24 UTC (permalink / raw)
To: 9fans
I used a special acme just for reading mail (I had enough screen to do so)
and ran a script to bind the proper namespace before reading the mail.dump
file...
Wasn't it the case that certain programs would look for a stack in /net.alt
if the /net one timeouted? Can't remember :(
andrey
On Thu, 13 Feb 2003, Dan Cross wrote:
> Thanks, Skip and Andrey,
> Unfortunately, I was hoping to avoid any mucking with namespaces,
> particularly for automated things (like outgoing mail). Alas, it
> seems impossible. Maybe I should go back to running both interfaces
> on the same IP stack. Hmm....
>
> - Dan C.
>
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-13 22:24 ` andrey mirtchovski
@ 2003-02-13 22:27 ` David Gordon Hogan
2003-02-13 23:14 ` Dan Cross
0 siblings, 1 reply; 22+ messages in thread
From: David Gordon Hogan @ 2003-02-13 22:27 UTC (permalink / raw)
To: 9fans
> Wasn't it the case that certain programs would look for a stack in /net.alt
> if the /net one timeouted? Can't remember :(
This behaviour is built into dial().
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-13 22:27 ` David Gordon Hogan
@ 2003-02-13 23:14 ` Dan Cross
2003-02-13 23:23 ` northern snowfall
` (2 more replies)
0 siblings, 3 replies; 22+ messages in thread
From: Dan Cross @ 2003-02-13 23:14 UTC (permalink / raw)
To: 9fans
In article <43f3eff7a65deecc69011f7b01d398e4@plan9.bell-labs.com> you write:
>> Wasn't it the case that certain programs would look for a stack in /net.alt
>> if the /net one timeouted? Can't remember :(
>
>This behaviour is built into dial().
I guess it's the 30-second timeout-tax I'm bummed out about. I guess
I don't see why, if I don't have a default route on the IP stack, it
would take 30 seconds to realize that sending a packet out of that stack
wasn't going to work.
- Dan C.
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [9fans] Speaking of routing....
2003-02-13 23:14 ` Dan Cross
@ 2003-02-13 23:23 ` northern snowfall
2003-02-13 23:24 ` David Gordon Hogan
2003-02-14 0:11 ` Russ Cox
2 siblings, 0 replies; 22+ messages in thread
From: northern snowfall @ 2003-02-13 23:23 UTC (permalink / raw)
To: 9fans
>
>
>I guess it's the 30-second timeout-tax I'm bummed out about. I guess
>I don't see why, if I don't have a default route on the IP stack, it
>would take 30 seconds to realize that sending a packet out of that stack
>wasn't going to work.
>
It'd be neat if there was a way to alter the dial() performance
per-user. Maybe
via a namespace config, or, environment variables (within some kind of
restraint).
Don
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-13 23:14 ` Dan Cross
2003-02-13 23:23 ` northern snowfall
@ 2003-02-13 23:24 ` David Gordon Hogan
2003-02-13 23:46 ` Dan Cross
2003-02-14 0:11 ` Russ Cox
2 siblings, 1 reply; 22+ messages in thread
From: David Gordon Hogan @ 2003-02-13 23:24 UTC (permalink / raw)
To: 9fans
> I guess it's the 30-second timeout-tax I'm bummed out about. I guess
> I don't see why, if I don't have a default route on the IP stack, it
> would take 30 seconds to realize that sending a packet out of that stack
> wasn't going to work.
Generally how it should work is that name resolution fails on
/net/cs, and dial moves on to /net.alt without having to time
out. This depends on you having ndb/cs set up right (one
for each interface with its own ndb file) and also ndb/dns for
DNS. Of course, if you're using numeric IP addresses you'll
get the timeout (unless you give /net.alt explicitly).
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-13 23:24 ` David Gordon Hogan
@ 2003-02-13 23:46 ` Dan Cross
0 siblings, 0 replies; 22+ messages in thread
From: Dan Cross @ 2003-02-13 23:46 UTC (permalink / raw)
To: 9fans
> > I guess it's the 30-second timeout-tax I'm bummed out about. I guess
> > I don't see why, if I don't have a default route on the IP stack, it
> > would take 30 seconds to realize that sending a packet out of that stack
> > wasn't going to work.
>
> Generally how it should work is that name resolution fails on
> /net/cs, and dial moves on to /net.alt without having to time
> out. This depends on you having ndb/cs set up right (one
> for each interface with its own ndb file) and also ndb/dns for
> DNS. Of course, if you're using numeric IP addresses you'll
> get the timeout (unless you give /net.alt explicitly).
No, everything is using hostnames; perhaps it'll work. I really need
to power everything up (the whole shebang is currently under my
girlfriend's bed in her apartment, and annoys her when she tries to
sleep; hence frequent power-downs) and test it for real, instead of
stabbing in the dark.
I would imagine that the IP stack would be smart enough, if it got a
packet destined for the outside network (for which it would have no
routes on the internal network) to say immediately, ``I don't know what
to do with this!'' and return an error, prompting dial() to proceed to
/net.alt without a perceptable delay. Am I wrong?
It also occurs to me that for smtp, I can do bind's in upas's scripts
that go immediately to /net.alt, since no SMTP traffic will ever be
sent on the internal network.
- Dan C.
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-13 23:14 ` Dan Cross
2003-02-13 23:23 ` northern snowfall
2003-02-13 23:24 ` David Gordon Hogan
@ 2003-02-14 0:11 ` Russ Cox
2003-02-14 0:17 ` Dan Cross
2 siblings, 1 reply; 22+ messages in thread
From: Russ Cox @ 2003-02-14 0:11 UTC (permalink / raw)
To: 9fans
dialing /net and then /net.alt is a clumsy hack.
if you want the appearance of one ip stack with
multiple interfaces then why not do that?
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-14 0:11 ` Russ Cox
@ 2003-02-14 0:17 ` Dan Cross
2003-02-14 0:21 ` David Presotto
0 siblings, 1 reply; 22+ messages in thread
From: Dan Cross @ 2003-02-14 0:17 UTC (permalink / raw)
To: 9fans
> dialing /net and then /net.alt is a clumsy hack.
> if you want the appearance of one ip stack with
> multiple interfaces then why not do that?
Because you guys never commited my change to tftpd to keep it from
listening to the world. Yeah, I could mitigate the damage that could
do by giving it a home directory with -h, but that's still not
something I really feel comfortable doing. Then there's the issue of
dhcpd listening to the outside as well. That's not a big deal since it
won't answer for hosts it doesn't know about (unless you tell it to),
but again, it's not something I feel entirely comfortable with. At
least with seperate IP stacks, I can be *real* selective about what
listens where.
Also, I can run an outside DNS server and an inside DNS server, using
seperate data files. The outside can't see anything about my internal
network, which I like.
Call me paranoid.
- Dan C.
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-14 0:17 ` Dan Cross
@ 2003-02-14 0:21 ` David Presotto
2003-02-14 0:29 ` northern snowfall
` (2 more replies)
0 siblings, 3 replies; 22+ messages in thread
From: David Presotto @ 2003-02-14 0:21 UTC (permalink / raw)
To: 9fans
Actually, dial does currently dial /net first and then
/net.alt. It's a hack I've never been too proud of
but I like it better than changing every single service
to check where the call is coming from, mistakes there
are too easy.
^ permalink raw reply [flat|nested] 22+ messages in thread* Re: [9fans] Speaking of routing....
2003-02-14 0:21 ` David Presotto
@ 2003-02-14 0:29 ` northern snowfall
2003-02-14 0:31 ` Dan Cross
2003-02-14 0:32 ` David Presotto
2 siblings, 0 replies; 22+ messages in thread
From: northern snowfall @ 2003-02-14 0:29 UTC (permalink / raw)
To: 9fans
Just random thought, has anyone played with the concept of a stackable
bind? i.e. instead of /net.alt bound over /net so that accessing /net/cs
always thunks /net.alt/cs, make it so thunk one in the target dir accesses
the top of the LIFO (/net.alt/cs), then, the successive thunk would access
the lower object: the true /net/cs. This would generate a multidimensional
file system rather than solely a linear. There could be fs calls for
resetting the
LIFO, somehow.. Just a thought.
Don
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-14 0:21 ` David Presotto
2003-02-14 0:29 ` northern snowfall
@ 2003-02-14 0:31 ` Dan Cross
2003-02-14 0:34 ` David Presotto
2003-02-14 0:32 ` David Presotto
2 siblings, 1 reply; 22+ messages in thread
From: Dan Cross @ 2003-02-14 0:31 UTC (permalink / raw)
To: 9fans
> Actually, dial does currently dial /net first and then
> /net.alt. It's a hack I've never been too proud of
> but I like it better than changing every single service
> to check where the call is coming from, mistakes there
> are too easy.
Okay, here's a question; I honestly don't understand something. Why
do so many servers take a ``-x'' option to set the network mount point,
instead of taking the (presumably more general) ``-A announce_string''
(or whatever you want to call it, if -A doesn't float your boat)? Can't
the nework directory be adequately specified using the announce string
syntax: /netdir/proto!addr!service or whatever?
- Dan C.
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-14 0:31 ` Dan Cross
@ 2003-02-14 0:34 ` David Presotto
0 siblings, 0 replies; 22+ messages in thread
From: David Presotto @ 2003-02-14 0:34 UTC (permalink / raw)
To: 9fans
[-- Attachment #1: Type: text/plain, Size: 47 bytes --]
Mostly because I got tired of typing that much.
[-- Attachment #2: Type: message/rfc822, Size: 2301 bytes --]
From: Dan Cross <cross@math.psu.edu>
To: 9fans@cse.psu.edu
Subject: Re: [9fans] Speaking of routing....
Date: Thu, 13 Feb 2003 19:31:38 -0500
Message-ID: <200302140031.h1E0VcM24680@augusta.math.psu.edu>
> Actually, dial does currently dial /net first and then
> /net.alt. It's a hack I've never been too proud of
> but I like it better than changing every single service
> to check where the call is coming from, mistakes there
> are too easy.
Okay, here's a question; I honestly don't understand something. Why
do so many servers take a ``-x'' option to set the network mount point,
instead of taking the (presumably more general) ``-A announce_string''
(or whatever you want to call it, if -A doesn't float your boat)? Can't
the nework directory be adequately specified using the announce string
syntax: /netdir/proto!addr!service or whatever?
- Dan C.
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-14 0:21 ` David Presotto
2003-02-14 0:29 ` northern snowfall
2003-02-14 0:31 ` Dan Cross
@ 2003-02-14 0:32 ` David Presotto
2003-02-14 0:44 ` Dan Cross
2 siblings, 1 reply; 22+ messages in thread
From: David Presotto @ 2003-02-14 0:32 UTC (permalink / raw)
To: 9fans
[-- Attachment #1: Type: text/plain, Size: 250 bytes --]
As for the delay, there wouldn't be one if your inside dns server
came back quickly with a nonexistant domain response. However, if
it comes back with an address that won't work in the inside or
doesn't come back, you're stuck with the timeout.
[-- Attachment #2: Type: message/rfc822, Size: 1523 bytes --]
From: David Presotto <presotto@closedmind.org>
To: 9fans@cse.psu.edu
Subject: Re: [9fans] Speaking of routing....
Date: Thu, 13 Feb 2003 19:21:27 -0500
Message-ID: <b17c702596cf67c84e7bdaaacfda622c@plan9.bell-labs.com>
Actually, dial does currently dial /net first and then
/net.alt. It's a hack I've never been too proud of
but I like it better than changing every single service
to check where the call is coming from, mistakes there
are too easy.
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [9fans] Speaking of routing....
2003-02-14 0:32 ` David Presotto
@ 2003-02-14 0:44 ` Dan Cross
2003-02-14 0:48 ` David Presotto
0 siblings, 1 reply; 22+ messages in thread
From: Dan Cross @ 2003-02-14 0:44 UTC (permalink / raw)
To: 9fans
> As for the delay, there wouldn't be one if your inside dns server
> came back quickly with a nonexistant domain response. However, if
> it comes back with an address that won't work in the inside or
> doesn't come back, you're stuck with the timeout.
That's fine, I understand that part. I guess I'm confused with what
the IP stack does with the packet it's trying to send if no route exists
for it. Why would it take time timing out if it had no place to send
it? That is, if the IP stack only knows how to send to hosts on
172.16.1.0/24, and no where else, why does it need to timeout when
it tries to send a packet to 146.186.132.2? More importantly, what's
it doing with that packet in the mean time? Not that I'm really worried
about it at this point, I'm just curious.
- Dan C.
^ permalink raw reply [flat|nested] 22+ messages in thread
end of thread, other threads:[~2003-02-14 0:57 UTC | newest]
Thread overview: 22+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2003-02-13 16:52 [9fans] Speaking of routing Dan Cross
2003-02-13 17:03 ` andrey mirtchovski
2003-02-13 17:13 ` Skip Tavakkolian
[not found] <20030213095533.L50666@ >
2003-02-13 22:16 ` Dan Cross
2003-02-13 22:24 ` andrey mirtchovski
2003-02-13 22:27 ` David Gordon Hogan
2003-02-13 23:14 ` Dan Cross
2003-02-13 23:23 ` northern snowfall
2003-02-13 23:24 ` David Gordon Hogan
2003-02-13 23:46 ` Dan Cross
2003-02-14 0:11 ` Russ Cox
2003-02-14 0:17 ` Dan Cross
2003-02-14 0:21 ` David Presotto
2003-02-14 0:29 ` northern snowfall
2003-02-14 0:31 ` Dan Cross
2003-02-14 0:34 ` David Presotto
2003-02-14 0:32 ` David Presotto
2003-02-14 0:44 ` Dan Cross
2003-02-14 0:48 ` David Presotto
2003-02-14 0:50 ` Dan Cross
2003-02-14 0:52 ` David Presotto
2003-02-14 0:57 ` Dan Cross
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).