Hi all, since several days I try to get NAT networking to work, which
is driving my nuts... I don't know what to do anymore. Maybe some
expert have a good tip for me. I have ready almost anything about this
topic and tested most stuff, but still no luck.
I want to run a web-server on a DomU. Hence I used the normal NAT
setup from xen.
Current setup & situation
1. DomO can access the internet
2. Dom0 can access the DomU
3. DomU (10.0.0.1) can access the internet
4. DomU can access Dom0
What's not working is that I can't reach the web-server running on DomU.
IFCONFIG Output
eth0 Link encap:Ethernet HWaddr 00:11:6b:94:d8:ea
inet addr:87.118.120.16 Bcast:87.118.120.255
Mask:255.255.255.0
inet6 addr: fe80::211:6bff:fe94:d8ea/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:60115200 errors:0 dropped:0 overruns:0 frame:0
TX packets:188967 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1572915748 (1.4 GB) TX bytes:21158242 (20.1 MB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:14 errors:0 dropped:0 overruns:0 frame:0
TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:700 (700.0 B) TX bytes:700 (700.0 B)
peth0 Link encap:Ethernet HWaddr fe:ff:ff:ff:ff:ff
inet6 addr: fe80::fcff:ffff:feff:ffff/64 Scope:Link
UP BROADCAST RUNNING NOARP MTU:1500 Metric:1
RX packets:69824162 errors:7 dropped:41 overruns:2 frame:0
TX packets:190910 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:611060332 (582.7 MB) TX bytes:21628510 (20.6 MB)
Interrupt:21 Base address:0xc00
vif0.0 Link encap:Ethernet HWaddr fe:ff:ff:ff:ff:ff
inet6 addr: fe80::fcff:ffff:feff:ffff/64 Scope:Link
UP BROADCAST RUNNING NOARP MTU:1500 Metric:1
RX packets:188967 errors:0 dropped:0 overruns:0 frame:0
TX packets:60115201 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:21158242 (20.1 MB) TX bytes:1572915818 (1.4 GB)
vif2.0 Link encap:Ethernet HWaddr fe:ff:ff:ff:ff:ff
inet addr:10.0.0.128 Bcast:0.0.0.0 Mask:255.255.255.255
inet6 addr: fe80::fcff:ffff:feff:ffff/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:684 errors:0 dropped:0 overruns:0 frame:0
TX packets:694 errors:0 dropped:3 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:43145 (42.1 KB) TX bytes:131433 (128.3 KB)
xenbr0 Link encap:Ethernet HWaddr fe:ff:ff:ff:ff:ff
UP BROADCAST RUNNING NOARP MTU:1500 Metric:1
RX packets:7385822 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:460560761 (439.2 MB) TX bytes:0 (0.0 B)
BRCTL Output
bridge name bridge id STP enabled interfaces
xenbr0 8000.feffffffffff no vif0.0
peth0
IPTABLES -L -t nat Output
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere eisxen tcp
dpt:www to:10.0.0.1:80
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Here I want to forward all traffic coming in for the external IP
address (eisxen) to 10.0.0.1:10
IPTABLES -L Output
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere 10.0.0.1 tcp dpt:www
ACCEPT all -- 10.0.0.1 anywhere PHYSDEV
match --physdev-in vif2.0
ACCEPT udp -- anywhere anywhere PHYSDEV
match --physdev-in vif2.0 udp spt:bootpc dpt:bootps
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Here the idea is that everything going to 10.0.0.1:80 is accepted.
ROUTE -n Output
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref
Use Iface
10.0.0.1 0.0.0.0 255.255.255.255 UH 0 0
0 vif2.0
87.118.120.0 0.0.0.0 255.255.255.0 U 0 0
0 eth0
0.0.0.0 87.118.120.1 0.0.0.0 UG 100 0
0 eth0
I can see HTTP request packets coming to my server.
tcpdump -i peth0 host 87.118.120.16 and port 80
tcpdump: WARNING: peth0: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode
listening on peth0, link-type EN10MB (Ethernet), capture size 68 bytes
21:02:08.669661 IP i59F4B4BF.versanet.de.37269 > eisxen.www: S
3736050736:3736050736(0) win 64000 <mss 1402,nop,wscale
0,nop,nop,timestamp[|tcp]>
But than nothing happens. Everything hangs. Nothing is
forwarded/routed to 10.0.0.1:80
I hope anyone can tell me what the problem is or what I should try to
get it to work.
Thanks a lot.
