RE: [Xen-users] Xen 3.4.2 networking help

[Simon Hobson <linux@xxxxxxxxxxxxxxxx>]

Jonathan Tripathy wrote:

> If you are refering to the OUTPUT chain of the Dom0 itself, surely 
> you wouldn't use physdev at all? Wouldn't you just use "iptables -A 
> OUTPUT -o ethx ...."?
Dunno about iptables specifics - I only use Shorewall and I know it's 
a limitation. But isn't "-o ethx" a device match ?
If there was a way around the limitation, I'm sure Tom Eastep would 
have figured it out.
> In any case, I don't block by interface on the Dom0's OUTPUT chain. 
> No real need to when the INPUT chain is protected with "iptables -A 
> INPUT -i ..."
> I only ever use physdev on the FORWARD chain, which works for both 
> incoming and outgoing traffic.
Well for me input restrictions are sufficient on Dom0 since no-one 
else is running stuff on Dom0. On my DomUs I also block outbound by 
default so that "less security minded" users have less scope to cause 
problems and/or there is less scope if a machine gets compromised.
--
Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users