[Xen-devel] Network filtering setup

[Jacob Gorm Hansen <jacobg@xxxxxxx>]

hi,

back in Xen 1.x days I had this wonderful setup where I did not have to
bother with vifs and bridges or fake MAC addresses, and the following
piece of C in dom0:

void setup_vfr_rules_for_vif(int dom,int vif,char* guest_ip)
{
    int f = open("/proc/xen/vfr",O_WRONLY);
    char s[256];
    sprintf(s,"ADD ACCEPT dstaddr=%s dstaddrmask=255.255.255.255 src=ANY
dstdom=%d dstidx=%d proto=any\n", guest_ip,dom,0 );
    write(f,s,strlen(s));
    sprintf(s,"ADD ACCEPT srcaddr=%s srcaddrmask=255.255.255.255 srcdom=
%d srcidx=%d dst=PHYS proto=any\n",guest_ip,dom,0 );
    write(f,s,strlen(s));
    close(f);
}

Would allow a domU to send and receive IP traffic through eth0,
including somehow magically getting ARP request answered our routed to
the right place.

I have been trying various things to get the same effect in Xen 3.x, but
to be honest my iptables knowledge is a bit rusty, so all I have been
able to come up with is a routed setup, but that only seems to work when
all the peers have the host hardcoded into their routing tables.

Does anyone have the perfect setup (list of iptables commands I suppose)
for this, preferable without bridging at the Ethernet layer?
NAT/Masquerading is not an option, as I prefer not to have any state
kept in dom0.

Thanks,
Jacob


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel