Jordi Espasa Clofent
2007-Aug-19 11:08 UTC
[Xen-users] Networking with DomU(s) with public statis IPs
Hi folks,
Let''s suppose next net/xen topology
---------
| Router |
----------
|
|
-------------------
| Dom0 |
-------------------
| |
| | ----------------------------
| ------------| DomU with static public IP |
| -----------------------------
| ----------------------------
------------| DomU with static public IP |
-----------------------------
And other domU with their own static public IP every one.
My doubts are:
* ¿Is it needed a public static IP also for dom0?
* When a connection petition (a web page, for example) arives from
router tu dom0 ¿how does know dom0 what is the correct domU to redirect
the petition?
I don''t know how this scenario should be configured. If there is any
tuto or manual which explain it I will be very grateful.
Thanks in advance.
--
Thanks,
Jordi Espasa Clofent
_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users
Marcin Owsiany
2007-Aug-19 13:43 UTC
Re: [Xen-users] Networking with DomU(s) with public statis IPs
On Sun, Aug 19, 2007 at 01:08:48PM +0200, Jordi Espasa Clofent wrote:> Hi folks, > > Let''s suppose next net/xen topology > > --------- > | Router | > ---------- > | > | > ------------------- > | Dom0 | > ------------------- > | | > | | ---------------------------- > | ------------| DomU with static public IP | > | ----------------------------- > | ---------------------------- > ------------| DomU with static public IP | > -----------------------------This is just one way to do things. Make sure you read http://wiki.xensource.com/xenwiki/XenNetworking> And other domU with their own static public IP every one. > > My doubts are: > > * ¿Is it needed a public static IP also for dom0?If your Dom0 acts as a router, then yes. If you use bridging, then no.> * When a connection petition (a web page, for example) arives from > router tu dom0 ¿how does know dom0 what is the correct domU to redirect > the petition?If you use bridging, then the bridge (inside dom0) just forwards frames to domUs. If you use routing, then it''s just a simple routing decision.> I don''t know how this scenario should be configured. If there is any > tuto or manual which explain it I will be very grateful.Depends on your need really, there are several ways. Make sure you read the material on the wiki, also googling for ''xen networking'' will be useful. -- Marcin Owsiany <marcin@owsiany.pl> http://marcin.owsiany.pl/ GnuPG: 1024D/60F41216 FE67 DA2D 0ACA FC5E 3F75 D6F6 3A0D 8AA0 60F4 1216 "Every program in development at MIT expands until it can read mail." -- Unknown _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users
Artur Linhart - Linux communication
2007-Aug-27 20:22 UTC
RE: [Xen-users] Networking with DomU(s) with public statis IPs
Hi, I''ve seen You have already the answers for Your questions... I have one little bit off topic remark to the mentioned proposed network topology - I think it is better to have no public addresses at all defined on Your servers and define only the rules for the forwarding on the service-level on Your firewall/routing system - TCP/UDP packets incoming to specific ports of the virtually assigned public IP addresses of Your firewall/router system, are then being forwarded to the internal private IP addresses. So only your firewall, which also virtually serves all such public addresses, knows from which public address has to be which service forwarded to which internal server with the private IP... I find this configuration the safest way, securing You from Your mistakes in the firewall configuration as well as from the mistakes in the configuration of the servers itself... And even if somebody can bring Your firewall to some error, which would cause there would be released all blocking packet rules and the firewall lets go "through" whole traffic from outside, without redefining the forwarding on the firewall Your servers cannot be hacked in other way as over the published and allowed services which You can possibly better secure than other services, which are obviously used for internal management of the servers, maintenance data transfers, etc. Sure, sometimes it is not possible, especially if You have to work with other protocols like TCP, UDP and ICMP, but in 95-99% of cases all obvious services run over the given 3 Protocols. With best regards Archie -----Original Message----- From: xen-users-bounces@lists.xensource.com [mailto:xen-users-bounces@lists.xensource.com] On Behalf Of Marcin Owsiany Sent: Sunday, August 19, 2007 3:44 PM To: xen-users@lists.xensource.com Subject: Re: [Xen-users] Networking with DomU(s) with public statis IPs On Sun, Aug 19, 2007 at 01:08:48PM +0200, Jordi Espasa Clofent wrote:> Hi folks, > > Let''s suppose next net/xen topology > > --------- > | Router | > ---------- > | > | > ------------------- > | Dom0 | > ------------------- > | | > | | ---------------------------- > | ------------| DomU with static public IP | > | ----------------------------- > | ---------------------------- > ------------| DomU with static public IP | > -----------------------------This is just one way to do things. Make sure you read http://wiki.xensource.com/xenwiki/XenNetworking> And other domU with their own static public IP every one. > > My doubts are: > > * ¿Is it needed a public static IP also for dom0?If your Dom0 acts as a router, then yes. If you use bridging, then no.> * When a connection petition (a web page, for example) arives from > router tu dom0 ¿how does know dom0 what is the correct domU to redirect > the petition?If you use bridging, then the bridge (inside dom0) just forwards frames to domUs. If you use routing, then it''s just a simple routing decision.> I don''t know how this scenario should be configured. If there is any > tuto or manual which explain it I will be very grateful.Depends on your need really, there are several ways. Make sure you read the material on the wiki, also googling for ''xen networking'' will be useful. -- Marcin Owsiany <marcin@owsiany.pl> http://marcin.owsiany.pl/ GnuPG: 1024D/60F41216 FE67 DA2D 0ACA FC5E 3F75 D6F6 3A0D 8AA0 60F4 1216 "Every program in development at MIT expands until it can read mail." -- Unknown _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users __________ Informace od NOD32 2469 (20070818) __________ Tato zprava byla proverena antivirovym systemem NOD32. http://www.nod32.cz _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users