[Xen-users] firewalls and Xen

[Luke <secureboot@xxxxxxxxx>]

I'm trying to do firewalling on Xen, and am becoming a bit confused.
I want to do filtering based on the interface name for a number of  
rules.
I'd like to say:
anything coming into dom0 from the internet is okay.

I tried:
anything coming in on physical interface peth0 with outgoing physical  
interface vif0.0 is okay.
This seems to work.



The one that doesn't work:

I want to say -
anything from any domU to dom0 is NOT okay

I said:
if physical interface of incoming packets is not peth0 and  
destination physical interface is vif0.0 reject.
This doesn't seem to work, as the dom0 is no longer able to connect  
to things.

Is there a good discussion as to which interfaces packets go to/from  
in which cases?  When do packets go through peth0?  When do they only  
go through the vif devices?
I'm using firehol to generate the IPTables scripts...

--
Luke

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users