Re: [Xen-users] configure advanced networking

[Adrian Chadd <adrian@xxxxxxxxxxxxxxx>]

On Sun, Jan 14, 2007, Rob Mokkink wrote:

> So only eth1 and eth2 are bridged.
> And i configure the guests to only use xenbr1 en xenbr2.
>  
> And after doing that, how do I limit access to dom0 to eth1 and eth2, or is
> that not possible?

dom0 does the bridging! Xen doesn't handle ethernet bridging; it "just" handles
physical server resources.

You can either hide the PCI devices for eth1/eth2 from dom0 (and expose them
to one guest each) or you can run them inside dom0 and have it do bridging.
Its better to do it the latter way in almost all cases because it gives you
fine-grained control and debugging access. It also lets you do cleverer things
such as using them as VLAN trunks and binding xen bridge interfaces to
vlan interfaces.

dom0 should be secure - after all, it can control Xen anyway.

(That said, I do remember some rumour about a "virtualisation ethernet card"
which supposedly allows for multiple VMs to access it somehow without going
through the root domain. I can guess how it works but I'd love to hear how
its actually implemented, if at all.)



Adrian


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users