I am trying to understand the differences between two network configurations for MAAS. My understanding is that the both achieve the same tasks where the first network connects to the internet and the second is managed by MAAS. The second network is then configured to forward traffic out via the public network interface.
Despite achieving the same results the configuration looks rather different which is where my confusion lies.
The first suggested configuration comes from the following Cloudbase Solutions Wiki page. They propose a simple
eth0 connecting to an external network and
eth1 going to an internal network and being given a static address:
# The primary network interface (external) auto eth0 iface eth0 inet dhcp # The secondary NIC (used internal for MAAS) auto eth1 iface eth1 inet static address 192.168.1.1 netmask 255.255.255.0
iptables rules are then held in
/etc/rc.local. As far as I can tell this has something to do with the forwarding of network traffic between
/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE /sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT /sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
The second configuration comes from the Ubuntu Openstack Installer for Multi Installer Guide. Their
/etc/network/interfaces file has more network interfaces but is similar to the previous configuration where
eth0 connects to an external network and
eth1 is internal:
# The loopback network interface auto lo iface lo inet loopback dns-nameservers 127.0.0.1 pre-up iptables-restore < /etc/network/iptables.rules auto eth0 iface eth0 inet dhcp auto eth1 iface eth1 inet manual auto br0 iface br0 inet static address 172.16.0.1 netmask 255.255.255.0 bridge_ports eth1
Questions that pop to my head at this stage are why does the
lo have a DNS Name Server and
iptables applied to it? Why is a bridged connection used in this instance?
iptable rules also look different and are placed in
/etc/network/iptables.rules and assume this enables the forwarding of traffic:
*nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 172.16.0.1/24 ! -d 172.16.0.1/24 -j MASQUERADE COMMIT
Can someone help explain what they are doing differently and why?
Let me know if this question is too big and I can chunk it down to separate questions but in the first instance I thought this provided more context.