Shorewall and Proxmox VE Cluster Configuration
This is a follow up article describing how to use Proxmox VE and Shorewall together. This article focus on using Shorewall within your Proxmox cluster. If you have not read the first article I recommend that you do so, it will aid your understanding with what is going in this one.
Network Layout and Shorewall Configuration
We are going to be using a bridging configuration. This is what Proxmox VE uses with by default. Bridging allows for easy migration of hosts without having to re-configure the firewall each time a machine is migrated.
I haven't seen it mentioned on Slashdot or LWN yet... and I even emailed LWN informing them... but Red Hat released Red Hat Enterprise Virtualization for Servers and the accompanying Red Hat Enterprise Virtualization Hypervisor products today. There are a slew of press releases and demo videos. They even had a webcast press conference. Oh, and hey, they also released all of the manuals too.
Didn't we see this coming?
Those who have been paying attention were expecting these releases... but I must admit that once I learned the details, I was shocked. Why? Because the Management side of the product requires Microsoft Windows products. What products? Windows Server 2003 is needed to run the management server. What services is the Windows Server running? IIS, Microsoft SQL Server, and it'll need to be connected to a Microsoft Active Directory Server for authentication and management.
Then of course once you have the proper Windows environment established you can actually install the RHELfS management app provided by Red Hat. Oh, if you don't have your own Microsoft SQL Server setup already, they can install the Express edition for you.
The Management server software includes a local management client app you can run on the management server but it also has a web-based version of the management app for remote management. Yeah, at last open standards! Not so fast. What browsers are supported by the web-based management app? Microsoft Internet Explorer 6 and up. Other browsers (according to the docs) are "untested". What? They haven't even tested them? What, you aren't curious if Firefox works? To clarify it appears as if the web-based management app sends Active-X based content to the web client... and that .Net technology is also used.
Ok, after reading those last few paragraphs, I'm guessing you are shocked too.
Proxmox VE does not come with a firewall by default there are several solutions to this problem but the most flexible and robust is integrating the Shorewall firewall. This document assumes a basic knowledge of the Shorewall program and will not cover all of Shorewall capabilities but will give you a good working model to get you started. For more advanced topics check out the Shorewall documentation.
Shorewall will have 3 zones: 1) the fw zone which is the Proxmox host, 2) the net zone which is the Internet and 3) the dmz zone which is where the virtual machines will reside. The hardware just has one network interface card; vmbr0 is a just a bridge interface.
This was my first year attending the Utah Open Source Conference. I was lucky enough to have Warren Sanders and Andrew Niemantsverdriet (both from the BillingsLUG) go with me and help staff the OpenVZ booth. I'm very thankful to Warren for providing transportation and doing all of the driving.
The weather cooperated and the 413 miles from Belgrade to Salt Lake City went quite smoothly. Warren and Andrew had an additional 150 miles from Billings to Belgrade. We left Belgrade about 11AM and arrived at the hotel in Sandy, Utah about 6PM.
We stayed at the official hotel for the conference which was the Residence Inn and the official special event price was $89 a night. I must say the accommodations were excellent with a full kitchen, king size bed, and pull out couch. All three of us stayed in the same room so Warren and Andrew had to put up with my snoring and funny smells.
Here is the video of my presentation from the Utah Open Source Conference 2009 entitled, "Introduction to OS Virtualization, Containers and OpenVZ". Warren Sanders manned the camera. I used Kdenlive to edit it and create the title screen. Attached below you can find PDFs for my slides, the OpenVZ Brochure we were handing out, as well as white paper from the Linux Foundation about who writes the Linux kernel.
For those interested in a much higher quality Ogg Theora version, you can find that here:
(right-click, save link as...)
I've been aware of Proxmox VE for a couple of years now. I've installed it a few times and tested it out. I have recommended it to others and know a few local people using it in production (at MSU-Bozeman and Rocky Mountain College for example). Since I'm involved in the OpenVZ community I've also noticed some of the contributions to OpenVZ that have come from Proxmox VE (vzdump for example) and have run into Martin Maurer in the comments section of this site. I asked him if he would be interested in doing an interview and he accepted.
What is Proxmox VE?
Proxmox VE is a very light-weight Debian-based distribution that includes a kernel with support for both KVM and OpenVZ. This means you get the best of both virtualization worlds... containers (OS Virtualization) and fully-virtualized machines (Machine Virtualization). Proxmox VE also includes a very powerful yet easy to use web-based management system with clustering features. Boot the Proxmox VE install media, answer a few simple questions, and within 10 minutes you have a very powerful virtualization platform you can manage from a web browser. Install it on one or more additional machines that are networked together and use Proxmox VE's cluster management tool to create a virtualization cluster that allows for centralized management, automated backups, iso media and template syncing, as well as virtual machine migration features. Proxmox VE really is a time saving turnkey solution... and it is freely available under a GPL license.
The family and I are visiting the in-laws in Great Falls over the holiday weekend. My family picked me up from work so I wasn't involved in the packing... and it just so happens that my wife didn't pack my laptop. :( As luck would have it, my father-in-law has two recently purchased laptops... and he also had a Dell Mini 9 he was working on for a friend... and he was kind enough to let me play with them.
MontanaLinux from LiveUSB thumbdrive
I usually have one or more USB thumbdrives in my pants pocket and almost always one of them is a bootable LiveUSB of a recent built of MontanaLinux i386 (my own remix of Fedora 11)... so at least I had something I could test with and get my Linux fix. The build I used was dated August 26th, 2009 so it had all of the Fedora updates released on or prior to that date.
Now onto the three laptops I tried out.
Here's a presentation from the recent Red Hat Summit in Chicago about KVM in Red Hat Enterprise Linux 5.4 that was released this week. I must say that KVM has come a long way and I look forward to using it. I'm hoping that the OpenVZ folks will build a flavor of the OpenVZ kernel based on the newer RHEL 5.4 kernel that includes both KVM and OpenVZ support. That would be awesome!
I hope at some point they release all of their presentations as OGV files.
A co-worker of mine inspired me to create a new enterprise CD with SP3 pre-installed the other day after I asked about an existing iso I had found on our network. I wondered if it were OEM or a new volume license with SP3 I had hoped it was.
He sent me a few links to some howto's and not all were the same. Looking over a few examples I quickly began replacing their Windows solutions with known Linux. Rather than recreate the wheel, I first searched how others have done it using Linux. These are a couple sites that have inspired my success:
- Slipstreaming Windows XP with Service Pack 3 in Linux by Jeremy Visser
- Slipstreaming Windows XP SP3 in Linux by Michael Gorven
- Intégration du Service Pack Windows sous Linux by Jacques Rouxel
It starts with the old IBM Linux commercial and then becomes a rap video. This comes from Linux.com and you can find full details here.
Is it me or are the Fake Linus Torvalds in the video actually using Mac OS X on Mac laptops?!?