This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-users] Force traffic out one interface

To: "Fajar A. Nugraha" <fajar@xxxxxxxxx>, Xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] Force traffic out one interface
From: Jonathan Tripathy <jonnyt@xxxxxxxxxxx>
Date: Sun, 13 Jun 2010 17:32:28 +0100
Delivery-date: Sun, 13 Jun 2010 09:34:02 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <AANLkTilC4ahwnNWCBRdGylQIxU7uPCFAKgqEtUh2VvgY@xxxxxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <4C14FD27.2080100@xxxxxxxxxxx> <AANLkTilz-8h3XvFjD4pQTF4ohOQcDBErsysBHpC6HAaf@xxxxxxxxxxxxxx> <4C1501E8.1010301@xxxxxxxxxxx> <AANLkTilC4ahwnNWCBRdGylQIxU7uPCFAKgqEtUh2VvgY@xxxxxxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv: Gecko/20100423 Thunderbird/3.0.4

On 13/06/10 17:24, Fajar A. Nugraha wrote:
On Sun, Jun 13, 2010 at 11:06 PM, Jonathan Tripathy<jonnyt@xxxxxxxxxxx>  wrote:
I'm pretty sure that by using ebtables (in the Dom0) at the "link layer", I
can force all traffic out via one interface. I believe that a "linux-bridge"
acts just like a stupid "Hub" (Ah remember those days before switches were
Do you know of any way to "force" all traffic via one interface on a
"stupid hub" or a switch?
Well, using ebtables (or something else), I was hoping to turn my "stupid hub" into a "plumbed" hub. By "stupid hub", I mean a device that doesn't map MAC addresses to ports, which I don't believe a linux bridge will do. I'm pretty sure some Cisco and HP switches can do this, but that's irrelevant as we're dealing with the bridge inside the Dom0.
So by only allowing traffic out via the interface which is
connected to the firewall, traffic if forced to go out that way.
"allowing" is somewhat easier. Try "man iptables", look for
"--in-interface" and "--out-interface", and create the rules on
forward chain.
So in a sense, "blocking all inter domU traffic" is easy enough.
However, if you want to "redirect all inter domU traffice to an
external firewall", then it's won't be easy (if at all possible).
This is why I wanted to use bridging, instead of IP routing, as since I believe that all ports on a bridge in linux are "promiscuous", by just blocking traffic between DomUs at the "link-layer" may do the trick. Again, only just a theory..
Of course, this is just theory, so I'm asking here as someone else may have
some experience.

My backup plan, as you rightfully mention, is to just do the firewalling in
the Dom0 itself. I'd just like to use a single external firewall for easy
Do you have a working solution to prevent physical hosts on the same
network from communicating with each other directly? If yes, adapting
it to Xen is easy, since in bridged mode Xen behaves similar to a
switch. Some colo provider does this by allocating small subnets (/30
or /29) on different vlans for each customer's server, effectively
forcing them to route all traffic via provider's router (at the cost
of many wasted IP addresses). This approach can be adapted easily
using many bridges (one for each vlan) on Xen. Another approach is the
one used by some DSL providers, forcing their users to use PPPoE.

No working solution yet. Hopefully soon


Xen-users mailing list