[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-users] Xen 3.0, setting up a virtual network with NAT

On Fri, Feb 03, 2006 at 04:31:47PM +0000, Richard Jones wrote:
> I've got a network set up as in the diagram below:
>    domU               domU
>    fake eth0          fake eth0
>        |                   |
>        +-----------+-------+
>                    |
>                dummy0
>                 * dom0 *
>                real eth0
>                public IP address
> In /etc/xen/xend-config.sxp I've got:
>  (network-script 'network-bridge netdev=dummy0')

What you want is:
(network-script network-nat)

> This all works fine in so far as domU can ping dom0 and dom0 can ping
> domU (ie. ping -> and
> ping -> is all OK).

This will work with the network-nat script too.

> If I enable routing in the kernel on dom0, then domU can try to ping
> the outside world, but of course the ping packets don't return because
> their source address is wrong (, not public IP addr).
> But if I add the following NAT rule:
>  iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
> it makes no difference!  Somehow these packets are bypassing normal
> routing and so not being masqueraded, and so their source address is
> not rewritten.
> Has anyone got this working?

Yes, I use this all the time. Use the network-nat script and vif-nat. It
should do exactly what you want.

> Note that I want to have a true virtual network here (not just domU
> NAT) because I want the domU's to be able to talk to each other.

The NAT scripts configure routing in dom0 and then they setup routes to
each of the domUs. So everyone can ping everyone else internally and
everyone can also go through NAT to the outside world.

CJ van den Berg


Xen-users mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.