[Xen-users] Creating a DMZ domU

["Christopher Isip" <cmisip@xxxxxxxxx>]

I am going to try to create a domU webserver.  My current setup is dom0 running Centos 5.1 with two ethernet interfaces. One is pcibacked to a asterisk domU ( and hence invisible in dom0 )and serves as the external interface there.  The Asterisk domU is my gateway to the internet, default route, dhcpd server, dns server and ip masquerade server as well.  The second interface in dom0 is the bridged interface to which all the domUs are connected (including the Asterisk domU). Everything seems to be working fine.  I have a simple two interface shorewall configuration in the Asterisk domU.  

My plan is to create a webserver domU and have shorewall run in it as well.  The domU will have default drop policies for all incoming and outgoing connections.  There will be a rule to allow incoming ssh and outgoing ssh.  There will be a rule for allowing incoming http as well. The webserver domU will only have one interface, and that is the bridged interface from domO.

In the Asterisk domU, I can write a DNAT rule to port forward http connections from the internet to the webserver domU. 

It seems that this should work If xen domUs really behave as if they are independent LAN hosts which so far they have in my setup.  My only question is how secure is this?.  Incoming connections from the internet for http port will be forwarded to a bridged interface. Or maybe this is where things will break.    

Anybody care to comment?

    Thanks
Chris


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users