Re: [Xen-users] Need support for xen network configuration

[Alexandre Kouznetsov <alk@xxxxxxxxxx>]

Hello.

El 09/07/14 08:00, Fritz Richter escribió:
> I have got a debian server with one eth0 attached to it. There are multiple 
> networks attached to the server:
>
> - Public IP Adress 1 (single public IP for dom0)
> - Public IP Adress 2 (single public IP for one virtual domU)
> - Internal IP Network 10.10.10.x (internal live network attached to 1..n domU)
> - Internal IP Network 10.10.20.x (internal dev network attached to 1..n domU)
All that on a single physical eth0?

For sake of security, your scenario will be better if you manage to add 
a second physical interface. Make eth0 to be "internal" and eth1 to be 
"external".
For sake of sanity, separate your different IP networks into different 
broadcast domain, VLAN is the most suitable option if they are to share 
the same physical port.
> The very first question is, how to setup the dom0 so that the system is 
> prepared to handle all different scenarios)?
First of all, don't set up IP on eth0 directly. Make the bridge to have 
the IP on it. I will use the bridge named xenbr0 in my example. Note 
that Dom0 don't need to have an IP address in all networks to which you 
wish to attach DomUs:
auto lo
iface lo inet loopback

#(no eth0 mention at all, xenbr will pick it up)

auto xenbr0
iface xenbr0 inet static
  address 10.10.10.5
  netmask 255.255.255.0
  bridge_ports eth0
  bridge_stp off
  bridge_fd 5

If you still wish your DomU to have a second (public) IP address, add a 
alias section:
auto xenbr0:0
iface xenbr0:0 inet static
  address   100.0.0.10
  netmask   255.255.255.0
  gateway   100.0.0.1

Then, attach your domU's VIFs to the created bridge. The IP settings of 
the DomU's interfaces should be set up in DomU's OS, just make sure they 
are attached to the correct bridge.
Reference: http://wiki.xen.org/wiki/XenNetworking

Note that I have omitted some configuration parameters on the 
interfaces. They have valid defaults, no point of setting them specifically.
Once again, I would like to advice against using the same bridge for 
public Internet IP and private LANs. Have internal and external networks 
on separate physical ports. Have different internal subnets on different 
VLANs.
Greetings.


--
Alexandre Kouznetsov


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users