[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-users] firewall xenU woes (help would be appreciated)

Adam Tworkowski schrieb:


Could someone please help me out with networking my firewall on xenU
configuration.  I have combed the list archives for posts on similar
configurations and getting bridging working properly but I am stuck and
generally confused.  I am trying to achieve the scenario below (ascii
borrowed from previous thread).

              | physical machine, dom0 |
              |   +---------------+    |
-- Internet -------+ Firewall domU +--------- Intranet
              |   +------+--------+    |
              |          |             |
              |          |   DMZ       |
              |    +-----+------+      |
              |    |            |      |
              | +--+--+      +--+--+   |
              | |domU1|      |domU2|   |
              | +-----+      +-----+   |

So far:

- physical ethernet device (will be two later) hidden from dom0 (no issue) - domU (fw) using ethernet device -- has access to internet on eth0 (no issue)

- domU1 and domU2 can only see domU when using bridge=xen-br0 although it 
appears that only on of the two can be active as if both are pinging domU there 
is much
packet.  Using vif = ['mac=xx.xx..., bridge=xen-br0'"].

Should domU1 and domU2 should be using xen-br0 at all or should this only be 
for domU and the former be using xen-br1 and xen-br2 respectively.

- I have attempted to have domU1 use vif = ['backend=fw'] without success

- I have also attempted to created xen-br1,xen-br2 and have the non-fw domUs 
use these: vif = ['bridge=xen-br1']

I am using a similar design (in my case the firewall still is in dom0, but that should not make a principal difference). I set up a separate bridge for every domU and connected each domU to its bridge.

The firewall sees every bridge as the gateway to an internal subnet (so every domU is an additional Intranet seen from the perspektive of the firewall). Now you only have to set up filter roules for iptables to allow/disallow connections between domUs and domU/Internet etc.

Hope that helps.


Xen-users mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.