Re: [Xen-users] antispoof with Xen 3

[Mike Wright <xktnniuymlla@xxxxxxxxxxxxxx>]

Dirk H. Schulz wrote:
> What I wonder about now is: what is the antispoof option for with xen 3?
> If I do not use antispoof, the xen network script registeres a domU with 
> the FORWARD chain with physdev matching anyway, so there is no need for 
> a toggleable antispoof button (and toggling it did not lead to any 
> different behaviour - at least I found none).
Many users isolate their dom0 and do not allow direct network
connectivity.  I'm guessing that's why the scripts do not automatically
add INPUT rules.

As far as the antispoof rule, it adds a src IP to the physdev match.
iptables ANDs those two conditions.  With antispoof off any IP from that
interface would be accepted; however, with antispoof on packets would
only be accepted if they come from the interface AND and have the spec'd IP.

Congratulations on your success.

:m)

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users