| |
|
 |
|
 |
|
|
|
| |
|
|
xen-users
Re: [Xen-users] firewalls and Xen
I'm not sure if it makes sense to include peth0 and vif0.0 in your
rules, as you mucking around with interfaces that are in the same
bridge. If you're just trying to firewall dom0 you should do something
like:
interface eth0 mydom0
server http accept
client all accept
...
Blocking traffic to the domU: Think of the domU as sitting on the same
lan that dom0's eth0 is connected to. Add rules to block traffic from
domU's IP address. If you *really* want to filter by interface, you
might want to think about using xen's routed configuration instead of
the bridged config.
Cheers,
Dan.
Luke wrote:
I'm trying to do firewalling on Xen, and am becoming a bit confused.
I want to do filtering based on the interface name for a number of
rules.
I'd like to say:
anything coming into dom0 from the internet is okay.
I tried:
anything coming in on physical interface peth0 with outgoing physical
interface vif0.0 is okay.
This seems to work.
The one that doesn't work:
I want to say -
anything from any domU to dom0 is NOT okay
I said:
if physical interface of incoming packets is not peth0 and
destination physical interface is vif0.0 reject.
This doesn't seem to work, as the dom0 is no longer able to connect
to things.
Is there a good discussion as to which interfaces packets go to/from
in which cases? When do packets go through peth0? When do they only
go through the vif devices?
I'm using firehol to generate the IPTables scripts...
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
|
|
| |
|
Home