I read your mail and those you posted in different previous threads and
I think that you should probably consider *not* using a bridge and using
pure routing instead:
- Do you really need bridge-only features (especially broadcasts from
domU to domU or broadcasts trespassing the dom0)? If I understand your
plans correctly, you want all your domUs to be isolated with their own
IP address and only communicating via a dedicated firewall. This way,
you would not need broadcasts between clients (this is only interesting
if you want to use LAN services between your domUs, because broadcasts
are not sent across the internet anyway).
- AFAIK, routing is more secure and faster than bridging, but somewhat
harder to setup.
- You could do what you posted below with routing. It might work with
bridging, too, but I don't know a good way to do that with a bridge.
With routing, you would need policy routing because of this elementary
You have (to make things easier to explain, in this example only 2) two
DomUs (let's say, 126.96.36.199 on vif-1.0 and 188.8.131.52 on vif-2.0), the
Domain-0 and a dedicated firewall between the Dom0 and the internet.
If 184.108.40.206 wants to reach any server on the internet (or vice versa), it
will trespass the firewall by default.
But if 220.127.116.11 wants to send (e.g. an e-mail) to 18.104.22.168 or (more
dangerous) wants to attack 22.214.171.124, they would only communicate via the
Domain-0 (without the firewall).
The problem is:
If you route 126.96.36.199 to vif-2.0 under all circumstances, it will bypass
the firewall if 188.8.131.52 sent the package.
If you route everything except 184.108.40.206 via eth0, you wont be able to
reach 220.127.116.11 any way.
The solution is:
You need to do policy routing.
If a package originates from the internet an should be sent to 18.104.22.168,
it must be routed to vif-2.0. But if it originates from 22.214.171.124, it must
be routed to eth0, so that it is sent to the firewall.
The firewall will then process the package and return it to the server,
which now must route the package to vif-2.0.
So it will take two policy routes:
route 126.96.36.199 via vif-2.0, if it is from eth0
route 188.8.131.52 via eth0, if it is not from eth0
I don't think that those routes would work with a bridge, so consider
Am 13.06.2010 17:45, schrieb Jonathan Tripathy:
> Hi Everyone,
> Does anyone know any rules that I could use (using iptable, ebtables,
> or otherwise) that could force all traffic coming from a guest to go
> out via a particular interface? I wish to stop "inter-guest"
> communication, without going via my firewall first.
> Xen-users mailing list
Xen-users mailing list