Re: [Xen-users] Comparing approcahes firewall on a Xen server. Any experience or recommendations?

[aleph2@xxxxxxxxxxx]

Hi Adam

On 2015-04-22 01:26, Adam Goryachev wrote:
> > I'd appreciate a little help in narrowing this down to the best 
> > approach, choosing simple where there's a choice.
> IMHO, use two physical ethernet ports on the dom0, and configure each
> of them as a bridge (your dom0 Linux OS will be used for this).
That's easy enough.  This approach, by NOT passing the interfaces 
through to the DomU with PCI-passthrough, can get bottlenecked at the 
bridge due to the DomU<->Dom0 traffic, no?
I've seen it discussed, but don't have any sense for the numbers -- 
load, throughput, etc.  I.e., is it something I should worry about?
> Physically, you will connect one of them to your LAN and the other to
> your WAN (router/modem/etc).
>
> The LAN port is bridged to xenbr0 and the wan port to xenbr1
> In dom0, xenbr0 is configured with an IP address the same as any
> normal server on your LAN (eg 192.168.1.12/24) and xenbr1 has no IP
> address, and is not configured/used.
> You configure to pass xenbr0 and xenbr1 to the domU as eth0 and eth1
> Within domU you use eth0 as your normal LAN interface (eg
> 192.168.1.1/24), and configure eth1 as your WAN interface (external IP
> address, or PPPoE or whatever is needed). Configure your firewall the
> same as if this was a physical server with two ethernet devices.
> Nothing special at all.
In this scenario, does the DomU need to be PV, HVM, or either?  I guess 
the answer depends on if the passed-through bridges need paravirt 
drivers?
There are a number of HVM-only (or, at least not easily PV'd) firewall 
appliances which might be nice to use.  Wondering out loud about 
performance issues of firewall in DomU ...
> If you use other domU's then you will only pass xenbr0 to them, and
> use only eth0 within the domU.
Got it.

> To complicate things further ...
Ok, wrote that down for now.  And gonna try to NOT complicate things 
further for a bit :-)

> I hope this is helpful.
Great start, thanks.

-------------------------------------------------

ONLY AT VFEmail! - Use our Metadata Mitigator to keep your email out of the 
NSA's hands!
$24.95 ONETIME Lifetime accounts with Privacy Features!  
15GB disk! No bandwidth quotas!
Commercial and Bulk Mail Options!  

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users