[Xen-users] Question regarding xen networking (bonding, xen-bridging)

[Jonas Meurer <jonas@xxxxxxxxxxxxxxx>]

Hello,

I fail to fully understand the xen bridge networking concept. In 
particular, the relation between bonding, bridging and Vlans is not 
clear to me. I have to admit that I'm not a network/bridging/routing 
expert at all. I'll try to explain setup and problem in detail. Please 
apologize if anything sounds illegitimate or absurd to you, or if I 
missed important information. My system is a Debian/Wheezy
Usually, we use a setup with different Vlan tags for each domU. 
Eth0/bond0 on the dom0 are untagged. For every domU, we create a 
interface 'vlanXXX' with eth0/bond0 as raw device, and a bridge 'brXXX' 
with the vlan interface as bridge port. brXXX is the bridge used for the 
domU:
auto vlanXXX
iface vlanXXX inet manual
    vlan_raw_device bond0

auto brXXX
iface brXXX inet manual
    bridge_ports vlanXXX
    bridge_stp off
    bridge_fd 0

This works quite well. But now I tried (and until now failed) to setup 
a Xen host with bridging, and dom0 + domUs in the same network (no Vlan 
management on dom0). After quite some time I got it working half the 
way. The bond0 device is set up as manual, and a bridge 'xenbr0' is 
created with interface 'bond0' as bridge port. The domU uses 'xenbr0' as 
bridge:
 On the dom0 LAN connection works as expected. Gateway responds, 
connection to the internet works. Dom0 and domU see each other.
But from domU, everything beyond the dom0 is unreachable, e.g. the 
gateway doesn't respond. MAC address from the domU is propagated to 
switches and gateway, I can see it in the arp table. In other words, the 
packets from domU find their way out, but the responding packets don't 
find their way back. A quick look at the iptables rules on dom0 give me 
the impression, that dom0 doesn't know how to handle packets for domU:
# iptables -L FORWARD
Chain FORWARD (policy ACCEPT)
target   prot opt source     destination
ACCEPT   all  --  anywhere   anywhere   PHYSDEV match --physdev-out 
vif1.0 --physdev-is-bridged
ACCEPT   udp  --  anywhere   anywhere   PHYSDEV match --physdev-in 
vif1.0 --physdev-is-bridged udp spt:bootpc dpt:bootps
ACCEPT   all  --  anywhere   anywhere   PHYSDEV match --physdev-out 
vif1.0 --physdev-is-bridged
ACCEPT   all  --  <DOMU-IP>  anywhere   PHYSDEV match --physdev-in 
vif1.0 --physdev-is-bridged

The last rule seems to accept packets with domU-IP as source, but I 
cannot find a rule which handles incoming packets for domU. In other 
words, the dom0 doesn't know what to do with packets for the domU. Is my 
assumption correct? If yes, why is this the case? Is it related to 
interface bonding?
I don't get the picture, maybe you can help me :)

Kind regards,
 jonas


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users