This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-users] Creating a DMZ domU

To: xen-users <xen-users@xxxxxxxxxxxxxxxxxxx>
Subject: [Xen-users] Creating a DMZ domU
From: "Christopher Isip" <cmisip@xxxxxxxxx>
Date: Sat, 12 Jul 2008 23:44:01 -0400
Delivery-date: Sat, 12 Jul 2008 20:44:37 -0700
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type; bh=BIhY1GnhE3y4Ew1rucjdzI2aHXm/zjmGURKxuJQNia8=; b=dEb33kYcW6Bluet1OoJXC4Y2GdLL1jKF1duPNsZ3dq7nc+s65jdhYtrfGC9o28qavX EvOZ96ne0NSTUUvOpQqBv+NsjHjYyvBU/IvV1GUrvVHw8Sq2H0XBxiIT4FqaFuJMI5d3 pkG7TCUozeY/Rs7aQvt73OuLfvN1rF9CKvTpg=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type; b=jZXqmOWQ1dp0kiqMR1WiaFvMZT2C3DTYMKSYQnqHLl5irObey296ATwxyTkruHgIaL tzYkdcL1HdJV4unUfRLG2lmR36YIususAq7KHjst+Bdo31QamYHo4FnIJXp9BMtNihIF HCNqJrRUBAUupEA+/oC2R3ayA3gKYBxMQegfU=
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
I am going to try to create a domU webserver.  My current setup is dom0 running Centos 5.1 with two ethernet interfaces. One is pcibacked to a asterisk domU ( and hence invisible in dom0 )and serves as the external interface there.  The Asterisk domU is my gateway to the internet, default route, dhcpd server, dns server and ip masquerade server as well.  The second interface in dom0 is the bridged interface to which all the domUs are connected (including the Asterisk domU). Everything seems to be working fine.  I have a simple two interface shorewall configuration in the Asterisk domU. 

My plan is to create a webserver domU and have shorewall run in it as well.  The domU will have default drop policies for all incoming and outgoing connections.  There will be a rule to allow incoming ssh and outgoing ssh.  There will be a rule for allowing incoming http as well. The webserver domU will only have one interface, and that is the bridged interface from domO.

In the Asterisk domU, I can write a DNAT rule to port forward http connections from the internet to the webserver domU.

It seems that this should work If xen domUs really behave as if they are independent LAN hosts which so far they have in my setup.  My only question is how secure is this?.  Incoming connections from the internet for http port will be forwarded to a bridged interface. Or maybe this is where things will break.   

Anybody care to comment?


Xen-users mailing list
<Prev in Thread] Current Thread [Next in Thread>