Re: [Xen-users] firewalls and Xen

[Daniel Goertzen <goertzen@xxxxxxxx>]

I'm not sure if it makes sense to include peth0 and vif0.0 in your 
rules, as you mucking around with interfaces that are in the same 
bridge.  If you're just trying to firewall dom0 you should do something 
like:
interface eth0 mydom0
  server http accept
  client all accept
  ...

Blocking traffic to the domU:  Think of the domU as sitting on the same 
lan that dom0's eth0 is connected to.  Add rules to block traffic from 
domU's IP address.  If you *really* want to filter by interface, you 
might want to think about using xen's routed configuration instead of 
the bridged config.
Cheers,
Dan.

Luke wrote:

> I'm trying to do firewalling on Xen, and am becoming a bit confused.
> I want to do filtering based on the interface name for a number of  
> rules.
> I'd like to say:
> anything coming into dom0 from the internet is okay.
>
> I tried:
> anything coming in on physical interface peth0 with outgoing physical  
> interface vif0.0 is okay.
> This seems to work.
>
>
>
> The one that doesn't work:
>
> I want to say -
> anything from any domU to dom0 is NOT okay
>
> I said:
> if physical interface of incoming packets is not peth0 and  
> destination physical interface is vif0.0 reject.
> This doesn't seem to work, as the dom0 is no longer able to connect  
> to things.
>
> Is there a good discussion as to which interfaces packets go to/from  
> in which cases?  When do packets go through peth0?  When do they only  
> go through the vif devices?
> I'm using firehol to generate the IPTables scripts...

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users