[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [Xen-users] Xen 3.4.2 networking help

Jonathan Tripathy wrote:

Yes, "-o ethx" is indeed a device match, but it works differently to physdev, which really only works well on fordwarded traffic (Although I think it is supposed to work on all bridged traffic)

I'll bow to your significantly greater knowledge in this area ! But the penny drops now, is ethx a real port or a bridge port ? I'll hazzard a guess filtering output to the bridge interface (eg br0) would be handled differently to filtering output to a specific port on the bridge.

Can you please post a link to information about this? I can't find anything on Google about this.

This for starters :
As described above, Shorewall bridge support requires the physdev match feature of Netfilter/iptables. Physdev match allows rules to be triggered based on the bridge port that a packet arrived on and/or the bridge port that a packet will be sent over. The latter has proved to be problematic because it requires that the evaluation of rules be deferred until the destination bridge port is known. This deferral has the unfortunate side effect that it makes IPSEC Netfilter filtration incompatible with bridges. To work around this problem, in kernel version 2.6.20 the Netfilter developers decided to remove the deferred processing in two cases: * When a packet being sent through a bridge entered the firewall on another interface and was being forwarded to the bridge. * When a packet originating on the firewall itself is being sent through a bridge.

Then I found this that suggests you need to use physdev

And I even found one of my old posts :
which references

Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.

Xen-users mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.