[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-users] Ideal(istic) Xen firewall design

Hi Dirk,

Dirk H. Schulz wrote:
> Hi Marcus,
> thanks for so much info!
> Just a short question before I start digging into your configs: What do
> you gain by running the firewall inside a privileged guest system
> instead of inside dom0?

It's modular, restartable, replaceable, ...
(ie. I can reboot the firewall without rebooting all the domUs)
oh, and someone gaining root access to the firewall won't be able to
play with xend, or the filesystems of the domUs.

I'm sure there are other good reasons :)

I've got all my domains (except dom0) on lvm+raid so snapshotting is a
great way of testing and making backups.

This is just the start, though ... more ideas being worked on atm.


Xen-users mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.