Re: [Xen-users] Xen with 'Routing' scripts

[Roland Paterson-Jones <roland@xxxxxxxxxxxx>]

Ian Pratt wrote:

> > I guess we want to restrict the dom-U to IP packets with 
> > IP/MAC pairs that match previous ARP results. Can ebtables in 
> > dom-0 filter this accurately?
> >    
> Sure. If you don't know all the rules at domain creation time you'll
> probably need to cook up your own little daemon to add rules/
>  
I think I might be able to achieve what I want with ebtables by brouting 
all outgoing traffic. So dom-0 is a router for outgoing traffic but a 
bridge for incoming traffic. I think I just have to enable 
ip_forwarding, but otherwise use the xen 'bridging' scripts.
> > Also, there will be more ARP'ing with bridging, since all the 
> > dom-U's will ARP independently (can we short-circuit ARP 
> > responses in dom-0?).
> >    
> Why would you want to? It's hardly high bandwidth.
>  
Well, ARP is broadcast and across all bridged networks. What if the 
dom-U did an ARP-bomb attack, for example. I don't know really. I guess 
you could rate limit ARP's with ebtables.
Anyway, if we're brouting outbound traffic, then we can use --arpreply 
<bogus-address> to short-circuit outbound ARP requests. They're no use 
anyway, if we're brouting all outbound traffic.
Does this all sound plausible or maybe even sensible?

Thanks for your help
Roland


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users