Re: [Xen-users] dom0 iptables

["Fajar A. Nugraha" <fajar@xxxxxxxxx>]

On Tue, May 5, 2009 at 2:42 AM, Mark Chaney <macscr@xxxxxxxxxx> wrote:
> Ok, I am setting up a new dom0 at a colo provider and usually the colo
> facility acts as my gateway, but at this new one, the provider is
> recommending that I use the server as its own gateway. That unfortunately
> doesnt work to well when it comes to iptables and my domU's. IPtables do not
> support virtual interfaces, so I can't just white list them unfortunately.

If I recall correctly, xen network bridge whitelist domUs by default.
Something like

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV
match --physdev-in vif2.0

You can use domU's vif interface as physdev. When setting up iptables
manually, it might be easier to use custom vif name using
"vifname=NAME" on vif line.

>
> I have tried these two rules, but no difference:
> iptables -I INPUT 1 -d 207.xxx.xxx.0/30 -j ACCEPT
> iptables -I OUTPUT 1 -s 207.xxx.xxx.0/30 -j ACCEPT

I believe that should be on FORWARD

Regards,

Fajar

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users