[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-users] routing in xen 3.0: icmp gets routed, but tcp/ip only partially

Hello folks,

I have this really strange routing problem that no amount of
googling and experimenting has been able to solve. Then again,
I'm new to Xen and "advanced" networking, so I could be missing
something very basic.

Summary: an unprivileged domU with PCI frontend for a NIC
is used as a router; icmp gets routed, but tcp/ip only
partially. I'm using a xen-unstable snapshot, dated March 31,
running on Ubuntu Dapper Drake.

Warning: this is a long post ;-)

Here's the network topology:

    |      ext      |
    | ( |
     +-------------+               +---------------+
     |  fw  (domU) | (eth1) -+-----|  dmz (domU)   |
     +-------------+         |     | ( |
         (eth0)            xenbr1  +---------------+
            +-- xenbr0
    |  xeno (dom0)  |
    |   (  |

The domU host "fw" has the e100 (Intel EtherPro 100) driver
loaded for eth2 (the PCI device was hidden from dom0). Hosts
"xeno" and "fw" are connected to bridge "xenbr0", hosts
"dmz" and "dmz" are connected through bridge "xenbr1".

Routing tables are at the end of this post.

Note that there's no firewall installed (yet); it's just
plain routing at the moment. All hosts have inetd running,
with services "daytime" and "echo" active; these services
are great diagnostics; they're simple and when "echo" works
then more complicated things like ssh will too.

What works?
 * ping from everywhere to everywhere (traceroute too)
 * full access from everywhere to "fw"
 * full access from "fw" to everywhere
 * full access from "dmz" to "xeno"
 * from "dmz": `telnet ext daytime`
 * from "xeno": `telnet ext daytime`

If I disable ip_forwarding on "fw" then it's not possible to
connect from "dmz" to "xeno" or vice versa; so traffic really
is going through "fw".

What does NOT work?
 * from "ext": `telnet dmz daytime`
 * from "ext": `telnet dmz echo`
 * from "dmz": `telnet ext echo`
 * from "xeno": `telnet ext echo`
In all these cases I get connected, but no output; however, I
do get output when I connect to a specific interface on "fw"
(iow, if host "fw0" is the ip-address of eth0 on "fw" then
`telnet fw0 echo` works fine from "ext").

It's as if no IP data (as opposed to syn/ack) wants to go from
"fw" to "ext"?

Routes defined on all hosts:
( is the gateway connected to my ADSL modem)

host "fw"
Destination     Gateway         Genmask         Flags  Iface   U      eth1     U      eth0     U      eth2         UG     eth2

host "xeno"
Destination     Gateway         Genmask         Flags  Iface   U      xenbr1     U      eth2         UG     eth2

host "dmz"
Destination     Gateway         Genmask         Flags  Iface   U      eth0         UG     eth0

host "ext" (not xen, separate machine on my LAN)
Destination     Gateway         Genmask         Flags  Iface   UG     eth0     U      eth0       UG     eth0         UG     eth0

Help me, Obi-Wan Xenobi; you're my only hope.

Regards, Peter Fokkinga

Xen-users mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.