[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-users] Xen and IPtables
On Thu, Apr 30, 2009 at 3:27 PM, James Clemence <jamesvclemence@xxxxxxxxxxxxxx> wrote: > I have been able to filter for the domUs via the forward chain taking out > the packets to each domU to a specific chain for that domU, and then handle > the packets with ACCEPT/DROP, as per usual. > > -m physdev --physdev-in peth0 --physdev-out vif${DOMUID}.0 -j <DOMU chain> > > However, I blanked on where to get hold of the traffic to the dom0? Does > that go to FORWARD too? Or does it simply hit INPUT? Shouldn't that be basic iptables stuff? If dom0 is not a router, INPUT should be enough. If it's a firewall or router, packages going through dom0 will be on FORWARD. As a side note, if you want to prevent iptables managing bridge traffic altogether you might want to use net.bridge.bridge-nf-call-arptables=0 net.bridge.bridge-nf-call-ip6tables=0 net.bridge.bridge-nf-call-iptables=0 on /etc/sysctl.conf, and run "sysctl -p" afterwards. Regards, Fajar _______________________________________________ Xen-users mailing list Xen-users@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-users
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |