[Xen-users] network-nat problem

["Robin Ericsson" <lobbin@xxxxxxxxx>]

Hi,

I'm trying get few domUs using network-nat, but something in my
configuration is blocking internet access from the domUs.

xend-config.sxp:
(network-script network-nat)
(vif-script vif-nat)

xm profile:
kernel = "/boot/vmlinuz-xen"
ramdisk = "/boot/initrd-xen"
extra = "text"
name = "web"
memory = "128"
disk = [ 'tap:aio:/var/lib/xen/web.img,xvda,w', ]
vif = [ 'ip=10.0.0.3, vifname=vif_web' ]

My interface comes up ok and I can ping this ip from dom0.
vif_web   Link encap:Ethernet  HWaddr FE:FF:FF:FF:FF:FF
         inet addr:10.0.0.130  Bcast:0.0.0.0  Mask:255.255.255.255
         inet6 addr: fe80::fcff:ffff:feff:ffff/64 Scope:Link
         UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
         RX packets:259 errors:0 dropped:0 overruns:0 frame:0
         TX packets:225 errors:0 dropped:0 overruns:0 carrier:0
         collisions:0 txqueuelen:32
         RX bytes:17088 (16.6 KiB)  TX bytes:23370 (22.8 KiB)

However, when I try to install CentOS on the domU I can't get out on
the internet. tcpdumping on vif_web tells me this:
12:17:15.759461 IP 10.0.0.3.1024 > dns1-fast.swip.net.domain:  4382+
A? mirror.nsc.liu.se. (35)
12:17:15.759516 IP 10.0.0.130 > 10.0.0.3: ICMP host dns1-fast.swip.net
unreachable - admin prohibited, length 71
12:17:15.759977 IP 10.0.0.3.1024 > dns1-fast.swip.net.domain:  4382+
A? mirror.nsc.liu.se. (35)
12:17:15.760026 IP 10.0.0.130 > 10.0.0.3: ICMP host dns1-fast.swip.net
unreachable - admin prohibited, length 71

Which means this is somehow blocked by my iptables. This is the rule:
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

I've tried to add a MASQ rule "-t nat -A POSTROUTING -o eth0 -j
MASQUERADE" but doesn't seem to help either. Any hints where I can
test this further?

--
       regards,
       Robin

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users