From: Thomas Halinka <lists@xxxxxxxxx>
Sent: Wed, October 27, 2010 2:40:45 AM
Subject: Re: [Xen-users] Xen 3.4.2 networking help
just a short step-by-step guide.
Am Dienstag, den 26.10.2010, 23:54 -0700 schrieb Alexander Zherdev:
> Pardon my long email below, I hope it will shed some light.
> I've googled and tried various things but nothing seem to work. I have
> upgraded to 3.4.3 of Xen and the kernel had an update too.
so u had a lot of fun ;-)
> My brain is fried right now. The only thing that seems to work is
> bridged mode. In bridged mode, my DomU gets the DHCP from dnsmasq and
> it can then surf the web. But I can't get to it from outside. In route
> or nat mode, the DomU can't even get out. Below is a test in NAT mode
> of xend.
Dont use NAT - its just MASQUERADING! Communication from internet would
be only possible through portforwarding....
> Below I have a pretty verbose output of iptables, ip r, and ifconfig
> right after I boot the physical server,
then after I start the DomU,
> and then after I apply the SNAT and DNAT settings (only ip r changes
> I appreciate any help that you have.
> Kernel: 2.6.18-194.17.4.el5xen
> Xen: 3.4.3
> Source: www.gitco.de
Please do the following.
- Disable default Firewall (only to get ur setup running)
# service iptables off
- Write down a ugly script, something like:
# i used /27 since your public-net was /27 too
# 192.168.128.65 is dom0-IP
brctl addbr xen-privatelan
ip a a 192.168.128.65/27 dev xen-privatelan
ifconfig xen-privatelan up
echo 1 > /proc/sys/net/ipv4/ip_forward
- and save it e.g. to
- make it executable
chmod +x /etc/xen/scripts/network-mynet
- change any kind of xen-networking-script to e.g.
######## reboot ur dom0 #####################
After reboot setup your windows-box to use the bridge "xen-privatelan"
- change domU.cfg
vif = [ 'type=ioemu, bridge=xen-privatelan, mac=00:16:3e:00:01:02' ]
- start ur domU
- setup nw-settings in domU (192.168.128.70/27 gw: 192.168.128.65)
- at this point u should be able to ping dom0 from ur domU!
access to internet and from internet to domU should NOT work
Otherwise triplecheck "brctl show", ip r s, and friends...
- Setup "1:1-NAT"
iptables -t nat -A PREROUTING -d XXX.XXX.XXX.70 -j DNAT
iptables -t nat -A POSTROUTING -s 192.168.128.70 -j SNAT --to-source
--> domU has internal IP 192.168.128.70 and is reachable via externalIP
--> domU should be able to ping the "internet"
--> domU should be available from "internet" trough XXX.XXX.XXX.70
Am i right? :-)