This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


RE: [Xen-users] Xen 3.4.2 networking help

Jonathan Tripathy wrote:

Yes, "-o ethx" is indeed a device match, but it works differently to physdev, which really only works well on fordwarded traffic (Although I think it is supposed to work on all bridged traffic)

I'll bow to your significantly greater knowledge in this area ! But the penny drops now, is ethx a real port or a bridge port ? I'll hazzard a guess filtering output to the bridge interface (eg br0) would be handled differently to filtering output to a specific port on the bridge.

Can you please post a link to information about this? I can't find anything on Google about this.

This for starters :
As described above, Shorewall bridge support requires the physdev match feature of Netfilter/iptables. Physdev match allows rules to be triggered based on the bridge port that a packet arrived on and/or the bridge port that a packet will be sent over. The latter has proved to be problematic because it requires that the evaluation of rules be deferred until the destination bridge port is known. This deferral has the unfortunate side effect that it makes IPSEC Netfilter filtration incompatible with bridges. To work around this problem, in kernel version 2.6.20 the Netfilter developers decided to remove the deferred processing in two cases: * When a packet being sent through a bridge entered the firewall on another interface and was being forwarded to the bridge. * When a packet originating on the firewall itself is being sent through a bridge.

Then I found this that suggests you need to use physdev

And I even found one of my old posts :
which references

Simon Hobson

Visit http://www.magpiesnestpublishing.co.uk/ for books by acclaimed
author Gladys Hobson. Novels - poetry - short stories - ideal as
Christmas stocking fillers. Some available as e-books.

Xen-users mailing list