This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-users] 3.4.x networking

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] 3.4.x networking
From: Mike Williams <mike@xxxxxxxxxxx>
Date: Sun, 13 Sep 2009 15:24:39 +0100
Delivery-date: Sun, 13 Sep 2009 07:25:26 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <20090913134626.GT31123@xxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <00de01ca3437$0eaf5e20$2c0e1a60$@com> <00fe01ca3476$6ca490b0$45edb210$@com> <20090913134626.GT31123@xxxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: KMail/1.12.1 (Linux/2.6.30-gentoo-r1; KDE/4.3.1; i686; ; )
On Sunday 13 September 2009 14:46:26 Pasi Kärkkäinen wrote:
> > I know it says the error is with vif-bridge, but that's stock, so I don't
> > know what could be wrong with it. I dont get these errors witht he Xen
> > 3.3.1 and Kernel i mentioned earlier.
> Did you diff vif-bridge script between xen 3.3.1 and xen 3.4.1 versions? 
> What are the differences? 
> What's the failing iptables command? Please paste the whole command here, 
> including the parameters.

frob_iptables in /etc/xen/scripts/vif-common.sh has changed, mostly by the 
addition of:

iptables "$c" FORWARD -m state --state RELATED,ESTABLISHED -m physdev \
    --physdev-out "$vif" -j ACCEPT 2>/dev/null

I found this not only caused the probably innocuous physdev depreciation 
warning, but caused the conntrack modules to be loaded due to the state check. 
The default conntrack size was far too small for me.
So either remove iptables, or comment out "handle_iptable" from 
/etc/xen/scripts/vif-bridge, I've no need for Xen to change iptables.

Mike Williams

Xen-users mailing list

<Prev in Thread] Current Thread [Next in Thread>