RE: [Xen-users] Xen 3.4.2 networking help

[Simon Hobson <linux@xxxxxxxxxxxxxxxx>]

Jonathan Tripathy wrote:

> Yes, "-o ethx" is indeed a device match, but it works differently to 
> physdev, which really only works well on fordwarded traffic 
> (Although I think it is supposed to work on all bridged traffic)
I'll bow to your significantly greater knowledge in this area ! But 
the penny drops now, is ethx a real port or a bridge port ? I'll 
hazzard a guess filtering output to the bridge interface (eg br0) 
would be handled differently to filtering output to a specific port 
on the bridge.
> Can you please post a link to information about this? I can't find 
> anything on Google about this.
This for starters :
http://www.shorewall.net/bridge-Shorewall-perl.html
> As described above, Shorewall bridge support requires the physdev 
> match feature of Netfilter/iptables. Physdev match allows rules to 
> be triggered based on the bridge port that a packet arrived on 
> and/or the bridge port that a packet will be sent over. The latter 
> has proved to be problematic because it requires that the evaluation 
> of rules be deferred until the destination bridge port is known. 
> This deferral has the unfortunate side effect that it makes IPSEC 
> Netfilter filtration incompatible with bridges. To work around this 
> problem, in kernel version 2.6.20 the Netfilter developers decided 
> to remove the deferred processing in two cases:
> 	*	When a packet being sent through a bridge entered the 
> firewall on another interface and was being forwarded to the bridge.
> 	*	When a packet originating on the firewall itself is 
> being sent through a bridge.
Then I found this that suggests you need to use physdev
http://bwachter.lart.info/linux/bridges.html

And I even found one of my old posts :
http://www.mail-archive.com/shorewall-users@xxxxxxxxxxxxxxxxxxxxx/msg02967.html
which references
http://www.shorewall.net/pub/shorewall/4.0/shorewall-4.0.1/releasenotes.txt

--
Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users