[Xen-users] can't get NAT to a VM on domU working

["Roberto Saccon" <rsaccon@xxxxxxxxx>]

Hi all 

I set up a debian sarge box with XEN 3.0 and LVM at my ISP. dom0 has a range of public IPs. As long as I used bridged networking to the VMs, everything worked fined, I could access all VMs by their IP . 
Then I switched in /etc/xen/xend-config.sxp to private virtal domU network with NAT :

(network-script network-nat)
(vif-script vif-nat)

and gave the VMs IPs  in the 10.0.0.x
 range

and I set on dom0 the follwing NAT rule for SSH access do a VM in domU

iptables -A PREROUTING -t nat -p tcp -i eth0 -d 72.232.68.66 --dport 9641 -j DNAT --to-destination  10.0.0.1:22

Now I can't access the VM from outside anymore, SSH Client to 72.232.68.66
:9641 keeps hanging. However I can ping the VMs in domU from dom0 and vice versa and also ping a VM form another VM. I do not have setup any addtional iptables rules.

The filter rules generted by the XEN scripts produced the following (iptables -L):

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  10.0.0.1             anywhere            PHYSDEV match --physdev-in vif5.0
ACCEPT     udp  --  anywhere             anywhere            PHYSDEV match --physdev-in vif5.0 udp spt:bootpc dpt:bootps
ACCEPT     all  --  10.0.0.2             anywhere            PHYSDEV match --physdev-in vif6.0
ACCEPT     udp  --  anywhere             anywhere            PHYSDEV match --physdev-in vif6.0 udp spt:bootpc dpt:bootps
ACCEPT     all  --  10.0.0.2             anywhere            PHYSDEV match --physdev-in vif7.0
ACCEPT     udp  --  anywhere             anywhere            PHYSDEV match --physdev-in vif7.0 udp spt:bootpc dpt:bootps
ACCEPT     all  --  10.0.0.2             anywhere            PHYSDEV match --physdev-in vif8.0
ACCEPT     udp  --  anywhere             anywhere            PHYSDEV match --physdev-in vif8.0 udp spt:bootpc dpt:bootps

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

And the NAT rules I get:

target     prot opt source               destination
DNAT       tcp  --  anywhere             66.68.232.72.reverse.layeredtech.com tcp dpt:9641 to:10.0.0.1:22

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Has anybody a clue what is missing to get the NAT working ? I had the impression that private NATted Network  with XEN 3.0 is supposed  to work out of the box when using the XEN provided scripts, so there must be somthing I am doing stupidly wrong !

regards
-- 
Roberto Saccon
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users