В данном руководстве будет рассмотрена настройка выделенного сервера с виртуализацией на основе OpenVZ. Доступ к контейнерам извне будет возможен посредством OpenVPN Итак: ОС — Centos 6.7,    IP сервера  — 1.2.3.4,  внутренняя сеть 10.55.0.0/24 Установка 
		
		
			
			
			
			
				
					
				|  | wget -P /etc/yum.repos.d/ https://ftp.openvz.org/openvz.repo   rpm --import https://ftp.openvz.org/RPM-GPG-Key-OpenVZ   yum install vzkernel1 | 
				
			 
		 
 /etc/sysctl.conf 
		
		
			
			
			
			
				
					
				|  | # On Hardware Node we generally need # packet forwarding enabled and proxy arp disabled net.ipv4.ip_forward = 1 net.ipv6.conf.default.forwarding = 1 net.ipv6.conf.all.forwarding = 1 net.ipv4.conf.default.proxy_arp = 0   # Enables source route verification net.ipv4.conf.all.rp_filter = 1   # Enables the magic-sysrq key kernel.sysrq = 1   # We do not want all our interfaces to send redirects net.ipv4.conf.default.send_redirects = 1 net.ipv4.conf.all.send_redirects = 0 | 
				
			 
		 
 vim /etc/modprobe.d/openvz.conf 
		
		
			
			
			
			
				
					
				|  | options nf_conntrack ip_conntrack_disable_ve0=0 | 
				
			 
		 
 SELinux 
		
		
			
			
			
			
				
					
				|  | echo "SELINUX=disabled" > /etc/sysconfig/selinux | 
				
			 
		 
 
		
		
			
			
			
			
				
					
				|  | yum install vzctl vzquota ploop | 
				
			 
		 
 iptables 
		
		
			
			
			
			
				
					
				|  | yum install iptables-services -y systemctl mask firewalld systemctl enable iptables systemctl stop firewalld systemctl start iptables iptables --flush | 
				
			 
		 
 
		
		
			
			
			
			
				
					
				| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT   iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT   iptables -A FORWARD -s 10.33.0.0/24 -j ACCEPT iptables -A FORWARD -d 10.33.0.0/24 -j ACCEPT   iptables -t nat -A PREROUTING --dst 1.2.3.4 -p udp --dport 2295 -j DNAT --to-destination 10.55.55.199:2295 iptables -t nat -A POSTROUTING -p udp -m udp -s 10.55.55.199 --sport 2295 -j SNAT --to-source 1.2.3.4:2295   iptables -t nat -A PREROUTING -p tcp -d 1.2.3.4 --dport 80 -i eth0 -j DNAT --to-destination 10.55.55.203:80 iptables -t nat -A PREROUTING -p tcp -d 1.2.3.4 --dport 443 -i eth0 -j DNAT --to-destination 10.55.55.203:443   iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE   service iptables save service iptables restart | 
				
			 
		 
 Создаём контейнеры 
		
		
			
			
			
			
				
					
				| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 | vzctl create 199 --ostemplate centos-7-x86_64 vzctl set 199 --save --name openvpn \     --ipadd 10.55.55.199 --hostname openvpn.co \     --nameserver 8.8.8.8 --nameserver 8.8.4.4 \     --onboot yes --cpus 1 --ram 512M --swap 1G --diskspace 5G vzctl start 199   vzctl create 210 --ostemplate centos-7-x86_64 vzctl set 210 --save --name postgress.dev --ipadd 10.55.55.210 \     --hostname postgres_dev.co \     --nameserver 8.8.8.8 --nameserver 8.8.4.4 \     --onboot yes --ram 8G --swap 8G --diskspace 10G vzctl start 210   vzctl create 211 --ostemplate centos-7-x86_64 vzctl set 211 --save --name mysql.dev --ipadd 10.55.55.211 \     --hostname mysql_dev.co \     --nameserver 8.8.8.8 --nameserver 8.8.4.4 \     --onboot yes --ram 8G --swap 8G --diskspace 10G vzctl start 211   vzctl create 220 --ostemplate centos-7-x86_64 vzctl set 220 --save --name web.dev --ipadd 10.55.55.220 \     --hostname web.co \     --nameserver 8.8.8.8 --nameserver 8.8.4.4 \     --onboot yes --ram 4G --swap 4G --diskspace 10G vzctl start 220 | 
				
			 
		 
 vzlist 
		
		
			
			
			
			
				
					
				|  | CTID NPROC STATUS   IP_ADDR       HOSTNAME 199   21   running  10.55.55.199  openvpn.co 210   21   running  10.55.55.210  postgres_dev.co 211   21   running  10.55.55.211  mysql_dev.co 220   21   running  10.55.55.220  web.co | 
				
			 
		 
 OpenVPN 
		
 Проверяем наличие… Читать далее »