[Xen-users] so close! an iptables rule away.....

[Rob Dyke <robdyke@xxxxxxxxx>]

Hi,

I've been making leaps and strides with Xen on FC4. It has been easy  
to get installed and to start our first virtual host.
I've got one outstanding issue with iptables that is preventing me  
progressing further.
This is a colo'd server. It has s single NIC with public IPs.
The bridge is set to come up binding vif* <> xen-br0 <> eth1.
I can start a virtual host and I am able to ping & SSH to the virtual  
host.
I am not able to resolve DNS query from my virtual host though -  
tcpdump shows Admin Prohibited
e.g.: 14:45:01.527142 IP dellserver.comwifinet.lan > vm- 
colo1.comwifinet.lan: icmp 80: host 217.160.133.239 unreachable -  
admin prohibited
If I drop IP tables then all name resolution works from the virtual  
machines.
I have not had any success with adding the iptables rules as shown in  
the wiki
# iptables -L -v -n
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source                
destination
8216  809K RH-Firewall-1-INPUT  all  --  *      *        
0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0             
0.0.0.0/0           PHYSDEV match --physdev-in eth1 ! --physdev-out eth1
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0             
0.0.0.0/0           PHYSDEV match ! --physdev-in eth1 --physdev-out eth1
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source                
destination
1844  216K RH-Firewall-1-INPUT  all  --  *      *        
0.0.0.0/0            0.0.0.0/0
Chain OUTPUT (policy ACCEPT 1256 packets, 373K bytes)
pkts bytes target     prot opt in     out     source                
destination
Chain RH-Firewall-1-INPUT (2 references)
pkts bytes target     prot opt in     out     source                
destination
   42  3108 ACCEPT     all  --  lo     *       0.0.0.0/0             
0.0.0.0/0
   19  1540 ACCEPT     icmp --  *      *       0.0.0.0/0             
0.0.0.0/0           icmp type 255
    0     0 ACCEPT     esp  --  *      *       0.0.0.0/0             
0.0.0.0/0
    0     0 ACCEPT     ah   --  *      *       0.0.0.0/0             
0.0.0.0/0
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0             
224.0.0.251         udp dpt:5353
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0             
0.0.0.0/0           udp dpt:631
3296  287K ACCEPT     all  --  *      *       0.0.0.0/0             
0.0.0.0/0           state RELATED,ESTABLISHED
    2   116 ACCEPT     tcp  --  *      *       0.0.0.0/0             
0.0.0.0/0           state NEW tcp dpt:143
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0             
0.0.0.0/0           state NEW tcp dpt:53
    9   740 ACCEPT     tcp  --  *      *       0.0.0.0/0             
0.0.0.0/0           state NEW tcp dpt:22
    7   336 ACCEPT     tcp  --  *      *       0.0.0.0/0             
0.0.0.0/0           state NEW tcp dpt:25
    4   228 ACCEPT     tcp  --  *      *       0.0.0.0/0             
0.0.0.0/0           state NEW tcp dpt:80
6681  732K REJECT     all  --  *      *       0.0.0.0/0             
0.0.0.0/0           reject-with icmp-host-prohibited
Running 2.6.12-1.1398_FC4xen0
I have read https://bugzilla.redhat.com/bugzilla/show_bug.cgi? 
id=161792 - is this the cause of my problems? do I need to run a  
newer kernel to resolve this issue?
Thanks for any advice - please prompt me to supply further info (e.g.  
credit card number, inside leg measurement, etc......)
/rob

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users