[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] Xenserver Iptables with openvswitch

  • To: xen-devel@xxxxxxxxxxxxx
  • From: Eddi Linder <eddi@xxxxxxxxxxxxxx>
  • Date: Tue, 20 May 2014 11:24:05 +0300
  • Delivery-date: Tue, 20 May 2014 08:35:47 +0000
  • List-id: Xen developer discussion <xen-devel.lists.xen.org>


I am currently working on a datapath solution whichÂwill be located between vm interfaces and the br-int ovs.Â
The idea is to implement something similar to the security groups in openstack - we want to install additional (TCP flag filter based) rules on theÂiptablesÂon the linux bridges to mirror/redirect specific packets to our own hypervisor process.
The scheme described on openstack's website shows that it uses a linux bridges for each interface in between the vm and the br-int ovs, and applies iptables rules on the interfaces connected to the bridge.Â

When trying to deploy a similar solution on xenserver, we found out that linux bridges and openvswitch kernel modules cannot coexist on this specific hypervisor (it is simply not supported on old kernels like it has).
So the question is, how did openstack implement the security groups on xenserver hosts,ÂwithoutÂusing the default linux bridge kernel module?

Thank you,

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.