Re: [Xen-users] Firewalling Xen?

["Grant McWilliams" <grantmasterflash@xxxxxxxxx>]

On Mon, Dec 15, 2008 at 1:05 PM, Dustin Henning <Dustin.Henning@xxxxxxxxxxx> wrote:

       In case it is relevant, I simply allow all traffic to traverse the forwarding chain when it is headed to a bridged destination.  I then simply run a firewall on dom0 and each domU as if they were all individual machines.  This seems to me like the way to go short of doing something more drastic with hardware isolation, but as a lot of people prefer to have much more complex firewall setups, it is certainly likely that at least some of them have good reason.
       Dustin

Keep in mind that this method means you'll be managing multiple firewalls. In my case it would be about 30 firewalls total. By separating the internal private network from the real network you can run with one firewall. However, having said that you can only forward each outside port to one port on one domU. This means if you have multiple web servers you can't forward the external port 80 to more than one internal possibly making it messy for external clients accessing the virtual machines by requiring them to access services on non-standard ports. In my setup this is fine because I only forward one port anyway (ssh) to allow remote logins.

In summary: 
To simulate a traditional open network where all virtual hosts (and all ports) are accessible by all external clients you will want to just make sure the peth0 physical network device is added to the bridge that Xen uses for domUs. This will require you to have firewalls on all DomUs in addition to a firewall on Dom0 as Dustin has outlined. 

To similate a private network where all traffic is routed through a firewall you'll want to use my original suggestion or similar. This entails setting up eth0 on Dom0 as a connection to the outside world and dummy0 as a connection to the Xen bridge where the DomUs reside. This will require you to configure a firewall on Dom0 that will filter and pass traffic from an externally accessible port to the desired port of the DomU in question. 


Grant McWilliams

Some people, when confronted with a problem, think "I know, I'll use Windows." 
Now they have two problems.
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users