[Xen-users] How to disable the public ip in Dom0 and enable on DomU

[Mirco Santori <mirco.santori@xxxxxxxxx>]

Hi All,

i come to you guys due a customization needed on my IT infrastructure.

I have a dedicated physical server (HP Proliant - Ram 12 Gb) where i configured some virtual machine for web services based .

I would like to make some changes to my current configuration in order to improve security and more.

The current configuration needs of two public ip address because i dont know how to configure the DomU (proxy) to have the public ip address without to configure the same on the Dom0 which will share the same nic to the domU.

I am running debian lenny and i am sure many of you know about the problem with the xen script which doesnt work in lenny.

So i decided to create a manual bridge in the /etc/networking/interfaces and to leave the xen script without any changes.

What i wish to do is to don't provide any public access to the dom0 (for security reason and to keep the other ip address for other things).

Here is the current configuration :

Dom0  : host -> ( public ip : 195.xxx.xx.220 - private ip : 192.168.1.10)

DomU  : proxy -> (public ip : 195.xxx.xx.221 - private ip : 192.168.1.11 )

DomU  : php server -> private ip -> 192.168.1.12

DomU  : java server -> private ip -> 192.168.1.13

DomU  : db server -> private ip -> 192.168.1.14

and here is how i would like to change :

Dom0  : host -> ( private ip : 192.168.1.10)

DomU  : proxy -> (public ip : 195.xxx.xx.221 - private ip : 192.168.1.11 )

DomU  : php server -> private ip -> 192.168.1.12

DomU  : java server -> private ip -> 192.168.1.13

DomU  : db server -> private ip -> 192.168.1.14

and here the interface's conf :

auto lo
iface lo inet loopback

auto xenbr0
iface xenbr0 inet static
        address xxxxxxx
        netmask 255.255.255.xxx
        network xxxxxxxx
        broadcast xxxxxxxx
        gateway xxxxxxx
        bridge_ports eth0
        bridge_stp off
        bridge_maxwait 0
        dns-nameservers xxx.xx
        dns-search xxx.com

auto xenbr1
iface xenbr1 inet static
        address 192.168.1.10
        netmask 255.255.255.0
        network 192.168.200.0
        broadcast 192.168.200.255
        gateway xxx.129
        bridge_ports eth1
        bridge_stp off
        bridge_maxwait 0
        dns-nameservers xxx.5
        dns-search xxx.com

Could someone give me some advices or suggest on how to reach my target ?

I am working with the network-bridge .. should i use NAT or ROUTE xen networking ?

The problem is when i tried to un-configure the eth0 in the Dom0 side with a fixed and public ip .. it would not available for the DomU (proxy) as well

many thanks for any answering

N

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users