Re: [Xen-users] Question regarding xen networking (bonding, xen-bridging)

[Alexandre Kouznetsov <alk@xxxxxxxxxx>]

Hello.

El 18/02/13 05:47, Jonas Meurer escribió:
>   On the dom0 LAN connection works as expected. Gateway responds,
> connection to the internet works. Dom0 and domU see each other.
Make sure, the DomU's interface is really attached to the intended bridge.
xm list
brctl show

> But from domU, everything beyond the dom0 is unreachable, e.g. the
> gateway doesn't respond. MAC address from the domU is propagated to
> switches and gateway, I can see it in the arp table. In other words, the
> packets from domU find their way out, but the responding packets don't
> find their way back.
Double check your routing and ipfilter (or whatever) configuration on 
your DomU and the gateway. This is the most common cause of issues with 
this description.

> A quick look at the iptables rules on dom0 give me
> the impression, that dom0 doesn't know how to handle packets for domU:
>
> # iptables -L FORWARD
> Chain FORWARD (policy ACCEPT)
> target   prot opt source     destination
> ACCEPT   all  --  anywhere   anywhere   PHYSDEV match --physdev-out
> vif1.0 --physdev-is-bridged
> ACCEPT   udp  --  anywhere   anywhere   PHYSDEV match --physdev-in
> vif1.0 --physdev-is-bridged udp spt:bootpc dpt:bootps
> ACCEPT   all  --  anywhere   anywhere   PHYSDEV match --physdev-out
> vif1.0 --physdev-is-bridged
> ACCEPT   all  --  <DOMU-IP>  anywhere   PHYSDEV match --physdev-in
> vif1.0 --physdev-is-bridged
>
> The last rule seems to accept packets [...]
Your policy is ACCEPT. So, unless there is a specific DROP or REJECT 
rule, you may count on netfilter does not prevent the packets from arriving.
> with domU-IP as source, but I
> cannot find a rule which handles incoming packets for domU.
That is a, mostly, antyspoofing rule. Most of Xen't iptabels setup is 
intended to protect the network from the DomU's, so it does not filter 
incoming traffic by default.
> In other
> words, the dom0 doesn't know what to do with packets for the domU. Is my
> assumption correct?
It does not need to know a too much. It a packet made it to the bridge, 
it should be picked up by the interface (member of the bridge) with the 
corresponding destination MAC. That is, unless there is some filtering 
preventing it, which seems not to be the case.
Check with tcpdump on Dom0 (bridge) and DomU (interface). You are 
supposed to see the same traffic involving your DomU's MAC address, 
including the incoming responses to outgoing connections. Any difference 
should bring some light to the matter.
> Is it related to interface bonding?
Should not. A incorrect bonding setup could prevent packets leaving 
physical interface, or arriving on it. If a packet is visible on the 
bridge, than it already has made it through the bond, so we may assume 
it works fine, unless it looses some packets.

--
Alexandre Kouznetsov


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users