RE: [Xen-users] Sucessful IPtables config on Dom0 anyone?

["Gary W. Smith" <gary@xxxxxxxxxxxxxxx>]

Ian,

 

Here is what we did.  We tweaked the vif-common.sh script and set the automated vif entries to be in a separate table.  Then we created our own iptables ruleset that contained this new table.  That way when a xen instance is created or destroyed it modifies it’s own table and all of your rules are still in place.  As you can see in the grep, I have added the VIF table.  The iptables-save is below that showing how it’s added allowing you to add your own rules.  In my case I also have a custom bridge script in place as this machine also has the firewall instance on it (my home office) but this script doesn’t modify iptables.  I had to drop all incoming traffic on eth1 (but forward is okay) otherwise Comcast cable flips out.

 

[root@xen09 scripts]# grep iptables vif-common.sh

  iptables -t filter "$c" VIF -m physdev --physdev-in "$vif" "$@" -j ACCEPT \

     "iptables -t filter $c VIF -m physdev --physdev-in $vif $@ -j ACCEPT failed.

If you are using iptables, this may affect networking for guest domains."

# Add or remove the appropriate entries in the iptables.  With antispoofing

  # Check for a working iptables installation.  Checking for the iptables

  # modules installed.  If iptables is not working, then there's no need to do

  if ! iptables -L -n >&/dev/null

 

[root@xen09 ~]# iptables-save

# Generated by iptables-save v1.3.1 on Fri Feb 16 07:45:10 2007

*filter

:INPUT ACCEPT [6461319:1044613875]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [2857055:11286763964]

:VIF - [0:0]

-A INPUT -m physdev  --physdev-in eth1 -j LOG --log-prefix "FW_INPUT: " --log-level 6

-A INPUT -m physdev  --physdev-in eth1 -j DROP

-A FORWARD -i xenbr0 -o xenbr0 -j ACCEPT

-A FORWARD -i xenbr1 -o xenbr1 -j ACCEPT

-A FORWARD -i lo -j ACCEPT

-A FORWARD -j VIF

-A FORWARD -j LOG --log-prefix "FW_FOWARD: " --log-level 6

-A VIF -m physdev  --physdev-in vif2.0 -j ACCEPT

-A VIF -m physdev  --physdev-in vif3.0 -j ACCEPT

-A VIF -m physdev  --physdev-in vif4.0 -j ACCEPT

-A VIF -m physdev  --physdev-in vif5.0 -j ACCEPT

-A VIF -m physdev  --physdev-in vif7.0 -j ACCEPT

-A VIF -m physdev  --physdev-in vif10.0 -j ACCEPT

-A VIF -m physdev  --physdev-in vif28.0 -j ACCEPT

-A VIF -m physdev  --physdev-in vif29.0 -j ACCEPT

-A VIF -m physdev  --physdev-in vif29.1 -j ACCEPT

-A VIF -m physdev  --physdev-in vif31.0 -j ACCEPT

-A VIF -m physdev  --physdev-in vif32.0 -j ACCEPT

COMMIT

 

 

 

From: xen-users-bounces@xxxxxxxxxxxxxxxxxxx [mailto:xen-users-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Ian Tobin
Sent: Friday, February 16, 2007 7:04 AM
To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-users] Sucessful IPtables config on Dom0 anyone?

 

Hi,

 

we are trying to secure our Xen boxes with IPtables on Dom0 but we always seem to get cut off and

can only cure it be rebooting the box.

 

Has anyone got a sucessful config they can share that secures the server with one nic?

 

We are using Xen 3.0.4

 

thanks

 

Ian

 

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users