Matt's questions

I have my KVM guests on a standard br0 bridge setup:

auto br0
iface br0 inet static
   address 192.168.1.117
   netmask 255.255.255.0
   network 192.168.1.1
   broadcast 192.168.1.225
   gateway 192.168.1.1
   bridge_ports eth0
   bridge_stp off
   bridge_fd 0

auto eth1
iface eth1 inet static
address 10.0.0.117
netmask 255.255.255.0
gateway 10.0.0.1
broadcast 10.0.0.225

eth1 is reserved for other traffic but a guest could simply change it's ip to connect to it.

What I am trying to achieve is dropping all traffic towards the host / outside / other guest as soon as a guest attempts to change either it's ip address or mac address (in an attempt to join the other network / spoof another guest)

I tried many interfaces (eth0, br0, tap0, tap+) but I cannot seem to get my rule right:

iptables -A INPUT -m physdev --physdev-in tap+ --physdev-out tap+ -s 192.168.1.205 -m mac ! --mac-source 52:54:5a:8d:77:8e -j DROP

IP forwarding is enabled- there are no other rules in iptables. Am I missing something- or even should I consider try to achieve this another way?

Looking to build a small (but future proof) Linux-KVM cluster with Ganeti

I'm starting my setup with 2 HVM machines, each with 2x 500GB SATA disk.

I've studied the documentation and I have a fair understanding of the system. However certain things are still unclear and I am unable to find straight answers. I'm hoping a more seasoned user can share some insight on these:

1. Should I use software RAID1 (mirror) on the physical machines?

My machines currently do not have hardware RAID controllers. Ganeti states that 'DRBD is RAID1 over network'. Somewhere claimed the old docs advised against using software raid, but I can not confirm this.

2. Grasping fail-over/mirror scenarios in the cluster ?

If I understand the limitations of DRBD correctly you can only sync to 1 other node. So in my scenario I'd use:

• [box1] master & node
• [box2] master-candidate & node

after boxN crashes I can deploy the other box and hopefully fix/rebuild the crashed box through standard Ganeti commands. If I add a box3 to the cluster - what can I do with it DRBD-wise? Is it like a hot-spare that should be deployed to restore another completely failed box? I'm not understanding the principle here.

3. Can I run *BSD instances ?

I'm able to run *BSD virtual machines on Linux-KVM, however Ganeti seems to be Linux-instance-only? I've seen the Ganeti instance manager which mentions FreeBSD in the issue queue but I'm unsure if I will be able to deploy *BSD instances through Ganeti? It's okay if manual work is involved setting them up, but I'm unsure I can use all of Ganeti's features on such an instance once it has been setup.

4. Out-of-band management for 'customers' ?

I've seen the VNC options and serial console options but since Ganeti claims to be 'intrusive on the host as it takes over SSH key management' I'm wondering if I can provide out-of-band commandline management to other users alongside it (ssh with fixed command for specific instance stop/start etc). Or does Ganeti provide something like that for 'single-instance-owners'?

Being new to virtualization in general, and somewhat new to Linux (using Debian Squeeze and coming from BSD) I have a hard time understanding what would be the best network bridging option for my host machine. Much -if not all- of the information on the net seems somewhat outdated.

There is info on br0, tun, tap and vnet and the like. I'm pretty much lost on what they all mean and do and would appreciate if someone knowledgeable could dumb it down for me.

What I would like is the best performance and flexible setup for my Debian host, where the (*BSD) guests can manage their own firewall (PF). The Squeeze host machine has two hardware NIC's behind a proper hardware router.

At this point I think it is wise to put the guests on their own dedicated hardware nic (eth1) and use an internal ip range (10.0.0.x) while the host uses eth0, but I'm very open to suggestions from the experts :)

We have webservers running nginx 7.65 along with fastcgi PHP5 and are looking into caching possibilities to speed up content delivery and lower system loads. The servers run different (custom) applications.

There are so much options for caching I am not sure what would be a sane setup. There is memcached, APC, Nginx' fastcgi_cache, proxy_cache....

I know memcached has the distributed ability as bonus but we do not need it at this point. In my experience memcached performs slower than APC if installed on the same machine as it is serving for, but this was some time ago.

I am not familiar with the Nginx fastcgi_cache or even the regular proxy_cache module. Is it comparable or is it something completely different?

What would be a good, sane caching method for Nginx w. FastCGI PHP5?

This is more of a 'best practice' or 'input appreciated' question.

Currently we manage about 5 webservers (in two DC's) that run Nginx for PHP websites. The plan is to redesign the setup so it is more manageable from an administrative point of view. One server is in a DC in another network, the rest in a single rack.

We sometimes have to move clients website(s) from one server to another and we would like to allow redundancy for certain clients etc. So a proxy seems a good start and any speed increase is highly welcomed, HAProxy seems like a good candidate for this both.

Our idea at this point is to make a single machine the HAProxy to everything else, so we can redirect anything anywhere, Seems smart to make that machine failover with something like CARP.

Any insights / input are highly appreciated.