[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] iptables nat redirect

Keir Fraser wrote:

I'm trying to do a nat redirect (traffic redirected from a router, not originally for the machine). I can see the network traffic, but the iptable rules do not appear to do anything. Is this possible on a virtual domain, and if not what needs to be done?

This should work okay from domain 0. Domain 0 is allowed to send any
packet to the physical network. Also, packets that match no other rule
are forwarded to domain 0.

iptables -L -v and
iptables -tnat -L -v

may help --- they tell you how many packets have matched each iptables
rule. You might therefore be able to work out whether packets are
reaching domain 0 and, if so, where they are getting misdirected.

-- Keir
I have verified that it does work on domain 0, but I'm actually trying to do the redirect on a different domain (non 0).

The router is using GRE to encapsulate traffic to the virtual machine. (verified working) The GRE interface on the virtual machine decapsulates the packet. (verified working) The iptable rule on the virtual machine matches the packet (verified working) The iptable rule on the virtual machine redirects the packet to a local port (not working)

Any suggestions?


This SF.net email is sponsored by: SF.net Giveback Program.
SourceForge.net hosts over 70,000 Open Source Projects.
See the people who have HELPED US provide better services:
Click here: http://sourceforge.net/supporters.php
Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.