Re: [Xen-users] LAN configuration?

[Marcus Brown <marcusbrutus@xxxxxxxxxxxxxxxx>]

Hi Alan,

Alan Murrell wrote:
> 
> Not sure if this is what you mean, but my Xensource server will have at
> least one machine in a DMZ (external web and email), and a couple of
> servers that will be sitting on the LAN (a file/print server, mythtv
> backend, maybe a couple others).
> 
> Since the physical LAN interface being assigned to the fireall (also on
> the Xensource server) will plug into a physical switch, I still want the
> domU LAN servers to appear as though they are on the LAN (and act as
> such)
> 
> I hope that's a bit clearer?  Basically, the LAN will have a couple
> physical machines (laptops, one workstation) and virtual servers.
> 

OK, the design and technique I explained last time should do this.
You could just use the firewall to DNAT the domains, and/or forward the
necessary ports.

eg. I have a mail server, web server, freenx server, etc all running as
domains, with the firewall (currently) running shorewall.

Mail Server: DNAT for the LAN (Green Zone),
DNAT            Zone GreenZone                  Host 192.168.254.51 in zone br5 
TCP     Any 143
DNAT            Zone GreenZone                  Host 192.168.254.51 in zone br5 
UDP     Any 143
AllowPOP3       Host 192.168.254.51 in zone br5 Zone RedZone                    
        Any
AllowSMTP       Zone GreenZone                  Zone RedZone                    
        Any

Web Server: DNAT for the Internet (Red Zone)
DNAT    Zone RedZone    Host 192.168.254.50 in zone br5         UDP     Any     
443             
DNAT    Zone RedZone    Host 192.168.254.50 in zone br5         TCP     Any     
443             
DNAT    Zone RedZone    Host 192.168.254.50 in zone br5         TCP     Any     
80

Freenx Server: DNAT for everywhere
DNAT    Any     Host 192.168.254.5:22 in zone br0       TCP     Any     XXXXX   
        
DNAT    Any     Host 192.168.254.5:22 in zone br0       UDP     Any     XXXXX
(where XXXXX is a high port)

I've probably missed a fair bit of detail, but I hope that
gives you an idea.

Marcus

ps. for the domains to actually be 'IN' the LAN, ie. in the same subnet
then the domains need to be on the same bridge as the LAN NIC (short story).
But then a routing firewall (iptables) would be pretty useless?
If the DNAT technique above doesn't suit, you might want to check out ebtables
and make a Brouter ... ???

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users