When ordering dedicated server sometimes we only got 1 IPv4, but that’s enough, we can using NAT for container with IP Tables and HAProxy to creating many OpenVZ VPS inside our dedicated server.
Install OpenVZ
yum update -y
yum install -y wget
cd /etc/yum.repos.d
wget http://download.openvz.org/openvz.repo
rpm --import http://download.openvz.org/RPM-GPG-Key-OpenVZ
yum install -y vzkernel.x86_64
yum install -y vzctl vzquota
yum install -y ploop
sed -i 's/kernel.sysrq = 0/kernel.sysrq = 1/g' /etc/sysctl.conf
sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
echo 'net.ipv4.conf.default.proxy_arp = 0' >> /etc/sysctl.conf
echo 'net.ipv4.conf.all.rp_filter = 1' >> /etc/sysctl.conf
echo 'net.ipv4.conf.default.send_redirects = 1' >> /etc/sysctl.conf
echo 'net.ipv4.conf.all.send_redirects = 0' >> /etc/sysctl.conf
echo 'net.ipv4.icmp_echo_ignore_broadcasts=1' >> /etc/sysctl.conf
echo 'net.ipv4.conf.default.forwarding=1' >> /etc/sysctl.conf
sysctl -p
sed -i 's/NEIGHBOUR_DEVS=detect/NEIGHBOUR_DEVS=all/g' /etc/vz/vz.conf
sed -i 's/options nf_conntrack ip_conntrack_disable_ve0=1/options nf_conntrack ip_conntrack_disable_ve0=0/g' /etc/modprobe.d/openvz.conf
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/sysconfig/selinux
yum install -y ntp
ntpdate -u us.pool.ntp.org
chkconfig ntpd on
reboot
Install OpenVZ Web Panel
Now we can install the OpenVZ Web Panel:
wget -O - https://raw.githubusercontent.com/sibprogrammer/owp/master/installer/ai.sh | sh
Open http://PublicIP:3000
in your browser (Login admin/admin
, make sure to change your default password).
For private IP, I pick this IP range 192.168.2.0/24
, and let say our public IP is 8.8.8.8
, and our virtual server IP is set to 192.168.2.1
using OpenVZ Web Panel.
Provide access for container to Internet
Use below rule so our container can access the internet:
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j SNAT --to 8.8.8.8
SSH for virtual server (port forwarding)
User can access their VPS trough SSH by using our public IP and custom port, I pick port 2122
.
iptables -t nat -A PREROUTING -p tcp -d 8.8.8.8 --dport 2122 -j DNAT --to-destination 192.168.2.1:22
Save the iptables:
service iptables save
Restart iptables:
service iptables restart
HAProxy (web access)
We can use HAProxy to bind any http request to our private IPs (DNAT). Install HAProxy first:
rpm -ivh http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
yum install -y haproxy
Now configure the /etc/haproxy/haproxy.cfg
, example:
frontend httpd
bind *:80
acl example_www hdr_end(host) -i example.com www.example.com
use_backend example_http if example_www
backend example_http
mode http
server localhost-stash-http 192.168.2.1:80
Start HAProxy and set to start automatically on reboot:
service haproxy start
chkconfig haproxy on
Nginx
If you prefer using nginx instead of haproxy than install nginx first:
rpm -ivh http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
yum install nginx
Than creating your nginx configurations, example:
server {
listen 80;
server_name example.com www.example.com;
location / {
access_log off;
proxy_pass http://192.168.2.1;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_buffering off;
proxy_buffer_size 128k;
proxy_buffers 100 128k;
}
}
Troubleshoot
When you start OpenVZ service and you got Running kernel is not an OpenVZ kernel message, you’ll just need to modify /boot/grub/grub.conf manually, example:
default=0
timeout=5
title OpenVZ (2.6.32-042stab090.5)
root (hd0,0)
kernel /boot/vmlinuz-2.6.32-042stab090.5 root=/dev/sda1 ro
initrd /boot/initramfs-2.6.32-042stab090.5.img
Important! pick kernel that has stab filename, if mistaken than our dedibox will not booting, after checking the grub.conf file properly than reboot it.