Xen users - Nov 2008 - Xen 3.3 bridged-networking

Hi

I don''t quite understand the new xen networking. We use network-bridge!
Everything works fine except that an iptables firewall on dom0 blocks all my
domU. In my firewall settings i use eth0. I figured out that eth0 is the
bridge but where is the interface for dom0? I want my firewall setting to
only apply to dom0 interface!
Since there is not anything like vif0.0 i don''t know on which interface
to
set up my firewall. Any suggestions how to solve this problem?

$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:1E:8C:AC:00:3E
          inet addr:XXX.XXX.XXX.XXX  Bcast:XXX.XXX.XXX.255
Mask:255.XXX.XXX.0
          inet6 addr: fe80::21e:8cff:feac:3e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10875232 errors:0 dropped:0 overruns:0 frame:0
          TX packets:630670 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:560653230 (534.6 MiB)  TX bytes:126624363 (120.7 MiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:11 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:800 (800.0 b)  TX bytes:800 (800.0 b)

peth0     Link encap:Ethernet  HWaddr 00:1E:8C:AC:00:3E
          inet6 addr: fe80::21e:8cff:feac:3e/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:18782863 errors:0 dropped:0 overruns:0 frame:0
          TX packets:955865 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5366361211 (4.9 GiB)  TX bytes:164506458 (156.8 MiB)
          Interrupt:17 Base address:0x8000

tap9.0    Link encap:Ethernet  HWaddr B6:E6:93:CB:50:0F
          inet6 addr: fe80::b4e6:93ff:fecb:500f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9419 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7884657 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500
          RX bytes:1101856 (1.0 MiB)  TX bytes:515896160 (491.9 MiB)

vif3.0    Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF
          inet6 addr: fe80::fcff:ffff:feff:ffff/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:37361 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11325864 errors:0 dropped:938 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:4752571 (4.5 MiB)  TX bytes:1377423212 (1.2 GiB)

vif9.0    Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)


Thanks for all your help
Max


_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

> Hi
> 
> I don''t quite understand the new xen networking. We use
network-bridge!
> Everything works fine except that an iptables firewall on dom0 blocks
all
> my domU. In my firewall settings i use eth0. I figured out that eth0
is
> the bridge but where is the interface for dom0? I want my firewall
setting
> to only apply to dom0 interface!
> Since there is not anything like vif0.0 i don''t know on which
interface to
> set up my firewall. Any suggestions how to solve this problem?
> 
Try:
echo 0 >/proc/sys/net/bridge/bridge-nf-call-iptables
echo 0 >/proc/sys/net/bridge/bridge-nf-call-ip6tables
echo 0 >/proc/sys/net/bridge/bridge-nf-call-arptables

That should make the firewall behave a bit more like what you are
expecting.

James

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users