Re: [Xen-users] Strange network problem (Etch)

Geoff Kirk
Thu, 04 Oct 2007 15:22:00 -0000

Let me try to explain what i did recently to setup some domU''s behind a
domU acting as a gateway between 2 bridges to play with shorewall.

Using the scripts here

http://renial.net/weblog/2007/02/27/xen-vlan/

i put them in /etc/xen/scripts and edited
/etc/xen/scripts/network-multi-vlan to look like

dir=$(dirname "$0")
"$dir/network-bridge" "$@" vifnum=0
"$dir/network-bridge-vlan" "$@" vlan=2

brctl show then gives
bridge name     bridge id               STP enabled     interfaces
vlanbr2         8000.feffffffffff       no              eth0.2
xenbr0          8000.feffffffffff       no              vif0.0
                                                        peth0

I then setup a domU to act as a gateway between xenbr0 and vlanbr2 in
domU config like this

vif = [ ''mac=00:16:3E:00:00:26, bridge=xenbr0,
vifname=gateway.0'',''mac=00:16:3E:00:02:10, bridge=vlanbr2,
vifname=gateway.1'' ]

and created a couple of other domU''s on vlanbr2. To give this.

vlanbr2         8000.feffffffffff       no              eth0.2
                                                        gateway.1
                                                        dom1.0
                                                        dom2.0
xenbr0          8000.feffffffffff       no              vif0.0
                                                        peth0
                                                        gateway.0

At this point i found an issue that anyone on my physical lan could ping
anything on vlanbr0 simply by creating a vlan on the same network. Which
i found by removing eth0.2 from vlanbr2 with "brctl delif vlanbr2
eth0.2" made them unreachable from anything not on the bridge and now
all traffic going to the vlanbr2 bridge has to be port forwarded through
the gateway domU. Enabling ip forwarding of course and NAT on the out
going interface. Don''t forget also domU''s on the bridge will
need to
know the gateway address to get outside eg.

route add default gw 10.0.0.1 dev eth0

regards
Geoff

Jens Seidel wrote:
> On Thu, Oct 04, 2007 at 04:18:33PM +0200, Heikki Levanto wrote:
>
>> I have not solved this problem yet, but I found out that the vif-nat
way
>> of doing things nicely sidestpes the problem, so suddenly it is not
>> nearly as pressing.
>>
>
> I had very similar network problems using Xen 3.1 (my dom0 network did
> no longer worked). In Xen 3.0.3 my dom0 network worked well but I had
> trouble getting an ethernet device in a domU.
>
> Using vif-nat is also my solution ...
>
> Jens
>
> _______________________________________________
> Xen-users mailing list
> Xen-users@lists.xensource.com
> http://lists.xensource.com/xen-users
>