WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-users

Re: [Xen-users] Bridge Hopping

On Thu, Jul 15, 2010 at 2:49 PM, Jonathan Tripathy <jonnyt@xxxxxxxxxxx> wrote:
> My question was whether the
> Dom0 could "forward" packets from one bridge to the other (This is what I
> wish to prevent). The 2 bridges that don't have an ip address assigned have
> untrusted clients connected to them

Under normal circumstances, no. Dom0 would forward traffic from one
bridge to another if they have ip address, and dom0 is setup to
function as a router. That is, dom0 would treat the bridge the same
way as it treats other interface. So if it does not have an IP address
on dom0 side, dom0 can't forward traffic from one bridge to another.

Note that I said "under normal circumstances". You should be able to
make it behave otherwise using things like
http://www.bjou.de/blog/2008/05/howto-copyteeclone-network-traffic-using-iptables/
, or by creating some userland program that uses libpcap.

-- 
Fajar

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

<Prev in Thread] Current Thread [Next in Thread>