[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-users] Bridged networking example

  • To: xen-users@xxxxxxxxxxxxx
  • From: Alexandre Kouznetsov <alk@xxxxxxxxxx>
  • Date: Tue, 15 Jan 2013 11:47:37 -0600
  • Delivery-date: Tue, 15 Jan 2013 17:48:34 +0000
  • List-id: Xen user discussion <xen-users.lists.xen.org>


El 15/01/13 11:25, Sven escribió:
Firewalling on DomO or on the gateway?
ACL on the switch?
Wrong network mask?

I figured it out: Since I followed the Gentoo guide, the kernel had a support
compiled in for netfilter to see bridge traffic. Adding a few rules or removing
support and my DomU is online.

xend is supposed to be able to add the needed ipfilter rules, to allow DomU's traffic, on a firewalled Dom0.


Honestly, Xen's iptables management never worked fine for me, I always used a external iptables script. Something like this:
iptables -A FORWARD -m physdev --physdev-in  vif+ -j ACCEPT
iptables -A FORWARD -m physdev --physdev-out vif+ -j ACCEPT

(Only on Xen 4.2 though. On 4.1 the bridge script
is broken and even adding it manually doesn't wire the DomU.)
Bridge-script is known to be broken since a while ago. The general recommendation is to build the bridge itself with OS's means, and make Xen to use as is.


Alexandre Kouznetsov

Xen-users mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.