[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Xen-users] Problem start iptables - udp broken (Workaround)
- To: "Torsten Lehmann" <tlehmann@xxxxxxxxxxxxx>
- From: "Abel Martín" <abel.martin.ruiz@xxxxxxxxx>
- Date: Wed, 29 Nov 2006 16:37:01 +0100
- Cc: xen-users@xxxxxxxxxxxxxxxxxxx
- Delivery-date: Wed, 29 Nov 2006 07:37:38 -0800
- Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=TrM/y+v6Dq/D3L83QvGNkqsvHWMrssIs3tU9+pv+YPcGXAQieEmXyOPjCTGaziUbpIgKDxPVeHnHb4DLWV269U8QGRBW7aMhudXRxejqecIYU6ZX9Fg1uixAufBlPu7LcSQINRzgygyyJaNWeEfMCGCDx/Nubor0FOG86yi8V0Y=
- List-id: Xen user discussion <xen-users.lists.xensource.com>
11/29/06, Torsten Lehmann <tlehmann@xxxxxxxxxxxxx> wrote:
On Wed, 29 Nov 2006, Torsten Lehmann wrote:
>
> - If one has very much time, then one sees also from time to time
> any packets in both directions....
>
> -> udp-packets not blocked generally.
>
> - Why the knot only solved after that to remove the module ip_conntrack?
>
> - to reproduce this problem is sufficient:
> # modprobe ip_conntrack
>
- Workaround: remove ip_conntrack from kernel:
# cd xen-3.0-testing/linux-2.6.16-xen0
# find . -name ip_conntrack.ko -exec rm -f {} \; -print
# find /lib/modules/`uname -r` -name ip_conntrack.ko -exec rm -f {} \; -print
l0# diff .config.old .config
...
< CONFIG_IP_NF_CONNTRACK=m
> # CONFIG_IP_NF_CONNTRACK is not set
l0:# make modules modules_install
l0:# /etc/init.d/netfilter start
Applying iptables firewall rules:
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
- "No chain...": rules which need ip_conntrack
- following rule-set was tested:
$IPTABLES -i $EXTIF -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# -> iptables: No chain/target/match by that name
# "--state" required ip_conntrack
$IPTABLES -A FORWARD -m physdev --physdev-in eth0 --physdev-out '!' eth0 -j
domU
$IPTABLES -A FORWARD -m physdev --physdev-out eth0 --physdev-in '!' eth0 -j
domU
$IPTABLES -A domU -p tcp -s 0/0 -m multiport --dport 23 -j LOG $LOG_LEVEL --log-prefix
"IN testdomU: "
# -> iptables: No chain/target/match by that name
# "-m physdev" required ip_conntrack (??)
Did you create the chain named domU with "iptables -N domU"? The
iptables state module won't work without the conntrack module. Please,
don't disable ip_conntrack and don't just copy and paste the rules I
sent. Adapt them to your needs. In my box there's no peth0, but eth0.
This is because the way networking scripts configure Xen networking
depending on the Xen package one installs.
$IPTABLES -i peth0 -A INPUT -p tcp -s 0/0 -m multiport --dport 23 -j LOG $LOG _LEVEL
--log-prefix "IN testpeth: "
# -> nomatch...rule not working
$IPTABLES -A INPUT -p tcp -s 0/0 -m multiport --dport 23 -j LOG $LOG_LEVEL --log-prefix
"IN test: "
# -> match....OK
regards Torsten
Launoc
Regards.
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
