This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-users] Re: Network isolation - PCI passthrough question

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] Re: Network isolation - PCI passthrough question
From: dave <dave@xxxxxxxxxxxxxxx>
Date: Mon, 20 Dec 2010 14:45:25 -0800
Cc: Jean Baptiste FAVRE <xen-users@xxxxxxxxxxx>
Delivery-date: Mon, 20 Dec 2010 14:46:25 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <4D0FCE60.4030500@xxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <4D0F6353.9020305@xxxxxxxxxxx> <ienqak$hic$1@xxxxxxxxxxxxxxx> <4D0F6E75.9060704@xxxxxxxxxxx> <ienv5g$bdh$1@xxxxxxxxxxxxxxx> <4D0F8314.4020908@xxxxxxxxxxx> <ieo1ei$nnd$1@xxxxxxxxxxxxxxx> <4D0FB526.6080906@xxxxxxxxxxxxxxx> <4D0FCE60.4030500@xxxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv: Gecko/20101208 Thunderbird/3.1.7

As far as I have seen, there are no way to attach domU nic directly to
my firewall domU. So, dom0 will always have access to network traffic
from domU, right ?

only if you add dom0 interface to bridge.  for example:

domu-2  :  tap2  --|
domu-1  :  tap1  --|
domu-fw :  tapfw --|
dom0    :  tap0  --|

so only do

brctl addif tap-br0 tap0

when dom0 needs to join the LAN, then

brctl delif tap-br0 tap0

when you want dom0 to leave the LAN.

Again, I'm not sure if this is what you're trying to do, but it will isolate dom0 from your virtual LAN.

Xen-users mailing list