[Xen-users] routing in xen 3.0 domU: icmp gets routed, but tcp/ip only partially

[Peter Fokkinga <peter@xxxxxxxxxxx>]

Hello folks,

I have a really strange routing problem that no amount of
googling and experimenting has been able to solve. Then
again, I'm new to Xen and "advanced" networking, so I could
be missing something very basic.

Summary: an unprivileged domU with PCI frontend for a NIC
is used as a router; icmp gets routed, but tcp/ip only
partially. I'm using a xen-unstable snapshot, dated
March 31, running on Ubuntu Dapper Drake.

Here's the network topology:

    +---------------+
    |      ext      |
    | (192.168.2.1) |
    +---------------+
            |
            |
         (eth2)
     +-------------+               +---------------+
     |  fw  (domU) | (eth1) -+-----|  dmz (domU)   |
     +-------------+         |     | (172.17.17.2) |
         (eth0)            xenbr1  +---------------+
            |
            +-- xenbr0
            |
    +---------------+
    |  xeno (dom0)  |
    |   (10.0.0.1)  |
    +---------------+


The domU host "fw" has the e100 (Intel EtherPro 100) driver
loaded for eth2 (the PCI device was hidden from dom0). Hosts
"xeno" and "fw" are connected to bridge "xenbr0", hosts
"dmz" and "dmz" are connected through bridge "xenbr1".

Note that there's no firewall installed (yet); it's just
plain routing at the moment. All hosts have inetd running,
with services "daytime" and "echo" active; these services
are great diagnostics; they're simple and when "echo" works
then more complicated things like ssh will too.

What works?
 * ping from everywhere to everywhere (traceroute too)
 * full access from everywhere to "fw"
 * full access from "fw" to everywhere
 * full access from "dmz" to "xeno"
 * from "dmz": `telnet ext daytime`
 * from "xeno": `telnet ext daytime`

If I disable ip_forwarding on "fw" then it's not possible to
connect from "dmz" to "xeno" or vice versa; so traffic really
is going through "fw".

What does NOT work?
 * from "ext": `telnet dmz daytime`
 * from "ext": `telnet dmz echo`
 * from "dmz": `telnet ext echo`
 * from "xeno": `telnet ext echo`
In all these cases I get connected, but no output; however, I
do get output when I connect to a specific interface on "fw"
(iow, if host "fw0" is the ip-address of eth0 on "fw" then
`telnet fw0 echo` works fine from "ext").

It's as if no IP data (as opposed to syn/ack) wants to go from
"fw" to "ext"?

Routes defined on all hosts:
(192.168.1.1 is the gateway connected to my ADSL modem)

host "fw"
Destination     Gateway         Genmask         Flags  Iface
172.17.17.0     0.0.0.0         255.255.255.0   U      eth1
10.0.0.0        0.0.0.0         255.255.0.0     U      eth0
192.168.0.0     0.0.0.0         255.255.0.0     U      eth2
0.0.0.0         192.168.1.1     0.0.0.0         UG     eth2

host "xeno"
Destination     Gateway         Genmask         Flags  Iface
172.17.18.0     0.0.0.0         255.255.255.0   U      xenbr1
10.0.0.0        0.0.0.0         255.255.0.0     U      eth2
0.0.0.0         10.0.1.1        0.0.0.0         UG     eth2

host "dmz"
Destination     Gateway         Genmask         Flags  Iface
172.17.17.0     0.0.0.0         255.255.255.0   U      eth0
0.0.0.0         172.17.17.1     0.0.0.0         UG     eth0

host "ext" (not xen, separate machine on my LAN)
Destination     Gateway         Genmask         Flags  Iface
172.17.17.0     192.168.8.1     255.255.255.0   UG     eth0
192.168.0.0     0.0.0.0         255.255.0.0     U      eth0
10.0.0.0        192.168.8.1     255.0.0.0       UG     eth0
0.0.0.0         192.168.1.1     0.0.0.0         UG     eth0


Help me, Obi-Wan Xenobi; you're my only hope.

Peter

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users