Re: [Xen-devel] Bridging firewall?

[Nicholas Lee <nic-lists@xxxxxxxxxxxxxx>]

On Tue, Jan 25, 2005 at 06:27:09PM +0100, Matthieu wrote:
> > So in a sense you've put your virtual servers on the same network as
> > some of your internal machines.
> >
> Yes, that's right but is it a problem ? 

No, only if you don't have a physical internal network. Like a machine
in a colo.


> Quite complicated ? it seems that you 're relying on the fact your inbound
> traffic will go to the eth0 trought you're firewall (trough dom1 in fact).
> I'm quite afraid about the fact that some packet cleverly forged can go
> trough dom0 without going trough dom1.

Relying on the way briding works. The internal hosts are on a seperate
bridge from the the external dom0. The domU1 bridge will need to be
tranversed for traffice to go from the external bridge to the internal
bridge.

If it doesn't work like that, then bridging is broken. Think of each
bridge as a switch, with domU1 being a smart switch. Connecting a host
to each switch by adding one of its interfaces to the bridge is like
joining two switch by a crossover cable. If there is no direct cable
between the external and internal bridges, but they have to instead
tranverse the bridging firewall switch then everything is as it should
be.


Nicholas


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel