Re: [Xen-users] dom0 can see connections from domU-s

[Thiago Camargo Martins Cordeiro <thiagocmartinsc@xxxxxxxxx>]

Hi!

 Who know who can fix this in Linux? Linus!?

 I do the most weird solution for this annoying problem:


iptables -t nat -F
rmmod nf_conntrack_ipv4 nf_conntrack ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 iptable_nat
# to make sure:
rmmod nf_conntrack_ipv4 nf_conntrack ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 iptable_nat


 I have this problem at my Linux border gateway, it can not even have the NAT module loaded, even if with no NAT rules, the Kernel drops a lot of packages on a busy network, saying that the NAT conntrack table is full... I hate it!   :-P

 The BSDs systems suffer from this evil behavior too?

 I never sent a mail to Linus before but, this can be a good time to do so.

 I say this because I believe that Linux should not drop network packets only by loading some module.

 ...or simply we do not know how to adjust it!

 I confess that today this is the only issue that I have with Linux.

Cheers!
Thiago

2009/8/24 Deyan Chepishev <dchepishev@xxxxxxxxx>

Hello,

I have a little problem.

I can see all the guest (domU) connections in dom0's /proc/net/ip_conntrack. As you can imagine the conntrack table starts to get filled when lots of connections are made on domU machines. Is there a way to stop this behavior?

My config is:
OS: Centos 5.3
XEN: xen-3.3.1-0 manually compiled from gitco's SRPMS
Kernel: 2.6.18-128.4.1.el5xen on bot dom0 and domU

I have had exactly the same problem before, but it disappeared after I manually compiled kernel 2.6.18 with xen patches. However I need an more up to date kernel now and want to use xen kernel from centos.

I need help if someone know how can I prevent this from happening.

Thank you

Regards,
Deian



_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users