Re: [Xen-users] XEN 3.0.4-1 / Iptables is not working properly

[Tomas Lund <tlund@xxxxxx>]

On Thu, 19 Apr 2007, Maik Brauer wrote:

> Hello,
>
> I've installed XEN3.0.4-1 and problems with the IPtables settings.
[snip]

Here is my reply from another (dead) thread with a similar problem:

---------- Forwarded message ----------
Date: Mon, 2 Apr 2007 01:40:10 +0200 (CEST)
From: Tomas Lund <tlund@xxxxxx>
To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] iptables in dom0 with bridge: no more outbound 
connections

On Sat, 30 Dec 2006, Peter Fokkinga wrote:

> Quoting Jerry Amundson <jamundso@xxxxxxxxx>:
> > > Peter Fokkinga wrote:
> > > > [iptables drops outgoing traffic when xend is running]
> > > > I get the feeling iptables does not remember its state, so my rule
> > > >   iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> > > > has no effect. Kernel modules xt_state and ip_conntrack are loaded.
> > Depends on your distro. Redhat for example,
> > "service iptables save" (overwriting /etc/sysconfig/iptables).
> I did not mean "remember" in the sense of "between reboots", but more like
> that iptables does not register the outgoing packet. So when the first
> "response" packet comes back and enters the INPUT rule it is seen as a NEW
> packet instead of ESTABLISHED or RELATED and therefore dropped.
I can confirm the problem Peter is describing.

When I try to connect to an external host, the "SYN_SENT" state does not 
show up in /proc/net/ip_conntrack and the SYN+ACK packet from the external 
host is dropped. (The "SYN_SENT" state is what allows the iptables 
"ESTABLISHED" match to occur.)
Before starting XEN (and the briding) it works with the same iptables 
rules. (See rules below)
I'm not sure this really has anything to do with XEN, but rather how the 
bridging works, but I "hope" that other people on this list has the same 
problem, and possibly someone has even found a solution?
Sample commands to reproduce the problem:

iptables -F
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -j DROP
telnet [host] [port]

//tlund


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users