|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-users] Implementing firewall functionality in dom0 host on behalf of domU guests
On Tue, May 15, 2012 at 10:43 AM, Andrew Finkenstadt <andy@xxxxxxxxxxxxxxx> wrote:
A few issues have arisen, attempting to duplicate this technique under more recent versions of Xen & their corresponding tools.
Installation process is: Base CentOS 5.7 install. # cd /etc/yum.repos.d
# yum update # yum groupinstall Xen # vi /etc/grub.conf
--> default = 0 # rm /etc/libvirt/qemu/network/autostart/default.xml # chkconfig --list NetworkManager
# chkconfig --list network # cd /etc/sysconfig/network-scripts # cp ifcfg-eth0 ifcfg-xenbr0
# vi ifcfg-eth0 --> DEVICE=eth0 --> HWADDR= (preserve setting)
--> > --> BRIDGE=xenbr0 --> NM_CONTROLLED=no
--> remove all other lines # vi ifcfg-xenbr0 --> remove HWADDR line
--> preserve all other lines --> DEVICE=xenbr0 --> TYPE=Bridge
--> DELAY=0 --> NM_CONTROLLED=no The preceding installation notes install a base operating system, removes the virtual bridge & private (NAT) network default for libvirt, and duplicates the xenbr0 needed for a "physically bridged ethernet" setting used in virt-manager for installation. Using these steps, NetworkManager is not activated, as confirmed by the chkconfig --list commands.
Both "xm" and "xl" tool sets appear to be available.
Using virt-manager to create virtual machines, it does not appears to create the /etc/xen/XYZZY.cfg file which allow changing of the vif= parameter setting, nor the addition of drives after the fact while using a configuration file. What is the right way to accomplish this? I realize I can work around the named-vif technique using the (new) "xm domid XYZZY" command.
I also have used the .CFG file to "clone" a virtual machine, with suitable changes in uuid, mac address, drive block-storage specifications and name. What is the right way to accomplish this?
The output from "iptables -L -n -v" is subtly different, related to physdev matching. Under CentOS xen 3.1, Chain FORWARD (policy ACCEPT 1957M packets, 291G bytes)
pkts bytes target prot opt in out source destination
Under CentOS xen 4.1.2, [root@xm00 ~]# iptables -L -n -v Chain FORWARD (policy ACCEPT 16 packets, 3564 bytes)
pkts bytes target prot opt in out source destination
What changes are necessary for the FORWARD chain to run the XYZZY firewall matching rules BEFORE passing on the packets in the ACCEPT rules? Additional information: [root@xm00 ~]# xm list Name ID Mem VCPUs State Time(s)
Domain-0 0 768 1 r----- 259.8 W2008BASE 1 2048 1 r----- 1.1
[root@xm00 ~]# brctl show bridge name bridge id STP enabled interfaces
xenbr0 8000.00a0cc62a23f no vif1.0 tap1.0
eth0 [root@xm00 ~]# ifconfig eth0 Link encap:Ethernet HWaddr 00:A0:CC:62:A2:3F
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:51748 errors:1 dropped:0 overruns:0 frame:0
TX packets:1480 errors:3 dropped:0 overruns:0 carrier:3 collisions:0 txqueuelen:1000
RX bytes:10843019 (10.3 MiB) TX bytes:214447 (209.4 KiB) Interrupt:20 Base address:0xe000
lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0
RX bytes:560 (560.0 b) TX bytes:560 (560.0 b) tap1.0 Link encap:Ethernet HWaddr FE:FF:FF:FF:FF:FF
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:11 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:1278 (1.2 KiB) vif1.0 Link encap:Ethernet HWaddr FE:FF:FF:FF:FF:FF
UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:500
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) xenbr0 Link encap:Ethernet HWaddr 00:A0:CC:62:A2:3F
inet addr:10.110.210.50 Bcast:10.110.210.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:51745 errors:0 dropped:0 overruns:0 frame:0 TX packets:1515 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0 RX bytes:10085885 (9.6 MiB) TX bytes:219145 (214.0 KiB)
[root@xm00 ~]# xm info host : xm00.h.heroengine.net
release : 2.6.18-308.4.1.el5xen version : #1 SMP Tue Apr 17 17:49:15 EDT 2012
machine : x86_64 nr_cpus : 4 nr_nodes : 1
cores_per_socket : 4 threads_per_core : 1 cpu_mhz : 2400
hw_caps : bfebfbff:20100800:00000000:00000940:0000e3bd:00000000:00000001:00000000 virt_caps : hvm
total_memory : 3327 free_memory : 2518 free_cpus : 0
xen_major : 4 xen_minor : 1 xen_extra : .2
xen_caps : xen-3.0-x86_64 xen-3.0-x86_32p hvm-3.0-x86_32 hvm-3.0-x86_32p hvm-3.0-x86_64 xen_scheduler : credit
xen_pagesize : 4096 platform_params : virt_start=0xffff800000000000 xen_changeset : unavailable
xen_commandline : dom0_mem=786432 dom0_max_vcpus=1 cc_compiler : gcc version 4.1.2 20080704 (Red Hat 4.1.2-50)
cc_compile_by : root cc_compile_domain : gitco.tld cc_compile_date : Wed Nov 9 22:31:30 CET 2011
xend_config_format : 4 [root@xm00 ~]# rpm -q -a | egrep "xen|libvirt|iptables|kernel"
xen-libs-3.0.3-135.el5_8.2 xen-libs-4.1.2-1.el5 libvirt-client-0.9.4-1
libvirt-0.9.4-1 xen-4.1.2-1.el5 libvirt-0.8.2-25.el5
kernel-2.6.18-274.el5 iptables-1.3.5-9.1.el5 iptables-ipv6-1.3.5-9.1.el5
kernel-2.6.18-308.4.1.el5 libvirt-python-0.9.4-1 kernel-xen-2.6.18-308.4.1.el5
_______________________________________________ Xen-users mailing list Xen-users@xxxxxxxxxxxxx http://lists.xen.org/xen-users
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |