Re: [Xen-users] Firewall in domU, networking in XEN

[Simon Hobson <linux@xxxxxxxxxxxxxxxx>]

S½awek Kosowski wrote:

> 1. I need to create a virtual interface in dom0 
> that will connect to ethint (giving an access to 
> LOC). Should I create an alias to eth0 (eth0:1) ?
No. You already have access to int from Dom0 - that's what the
   address 192.168.1.x
   netmask 255.255.255.0
   gateway 192.168.1.1
bit of the config does for you. The bridge itself 
becomes the interface in Dom0 - it should show as 
ethint in the output from ifconfig.

> 2. I cannot configure ethdmz in the way that 
> you've shown. It works fine if I assign IP as in 
> case ethint
The docs I found says it should work - not a 
setup I've used personally. Perhaps someone else 
can confirm if I've got the syntax correct.
Do you get an error message ? Just "nothing" ? 
Does the bridge appear (brctl show) ?
> 3. How should I keep the configuration of eth0 
> if it won't have any IP (in dom0) - it will be 
> bridged to domU1 ?
> Should it be something like this:
>
> auto eth0:0
>
>  iface eth0:0 inet manual
No, you just don't configure it at all. It will 
be bridged to a DomU and Dom0 will not have any 
access.

Before starting any DomUs, brctl show should give something like :
bridge name     bridge id               STP enabled     interfaces
ethext          8000.xxxxxxxxxxxx       no              eth0
ethint          8000.xxxxxxxxxxxx       no
ethdmz          8000.xxxxxxxxxxxx       no

After starting the first DomU as your firewall 
device, you should see it change to something 
like :
ethext          8000.xxxxxxxxxxxx       no              vifa.b
                                                        eth0
ethint          8000.xxxxxxxxxxxx       no              vifa.c
ethdmz          8000.xxxxxxxxxxxx       no              vifa.d

Not too sure about the "vifa.b" stuff, I give my 
DomUs explicit interface names, so I might see :
ethext          8000.xxxxxxxxxxxx       no              fwext
                                                        eth0
ethint          8000.xxxxxxxxxxxx       no              fwint
ethdmz          8000.xxxxxxxxxxxx       no              fwdmz

Eg, in the config for my firewall DomU, I might have something like :
vif  = [ 'bridge=ethext,vifname=fwext', 
'bridge=ethint,vifname=fwint', 
'bridge=ethdmz,vifname=fwdmz' ]
I just like having meaningful names - makes 
things easier when you have a few VMs running. On 
the other hand, it causes some confusion when 
cloning a VM and I forget to change the names !
--
Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users