[Xen-users] dom0 iptables FORWARD default DROP?

["John Hannfield" <hal9020@xxxxxxxxx>]

Hello,
What is the best policy for the FORWARD chain in dom0 iptables?
Can I use a default DROP policy?
I notice when domains are created it adds the extra rules to the
FORWARD chain, to
allow traffic to the guests. However, if iptables is restarted, all
these rules are lost.

Do I need a rule per VPS, or can I use a single catch all to handle all of them?

http://wiki.xensource.com/xenwiki/XenNetworking
Suggests using this:

-A FORWARD -m physdev --physdev-in eth0  ! --physdev-out  eth0  -j ACCEPT
-A FORWARD -m physdev --physdev-out eth0 ! --physdev-in  eth0  -j ACCEPT

What is the recommended way to handle the FORWARD chain in dom0 iptables?

--

John

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users