WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-users

Re: [Xen-users] ssh issues on DomU

Hi,

Heiko Wundram wrote:
Do you have any firewall in place that might be dropping connections ?
No, the closest thing would be the standard iptables rules on Dom0 ...
but it looks "okay" to me.

It isn't.

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED PHYSDEV match --physdev-out vif3.1
ACCEPT     all  --  anywhere             anywhere            PHYSDEV
match --physdev-in vif3.1
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED PHYSDEV match --physdev-out vif3.0
ACCEPT     all  --  anywhere             anywhere            PHYSDEV
match --physdev-in vif3.0
ACCEPT     all  --  anywhere             anywhere            PHYSDEV
match --physdev-in peth1

These rules basically say that any traffic coming in from anywhgere (the
outside) and being directed towards your DomU is only valid if it is
part of an existing connection (see the state RELATED,ESTABLISHED on the
physdev-out matches, which are driven by the stateful xtables match of
the Dom0 kernel), whereas the DomU is allowed to do any traffic (see the
physdev-in match).

The DomU machine can host a website, no problem. It can reply to pings sent to it by another machine on the 192.168.1.0 network just fine.

ssh works fine for the 192.168.10.201 going through Dom0 in the same manner as http [modem / forwarding -- modem is on 192.168.10.0 network].

So, ssh is different from _other_ traffic types for some reason.

The Dom0 is allowed to do traffic to all DomUs, because the packets the
Dom0 generates go through INPUT and OUTPUT, but not through FORWARD. You
might want to check the iptables generation on your Dom0.

I didn't craft the iptables rules on Dom0, it is standard installation with bridged networking setup -- okay, I had to mod the network script for xen, but I didn't fiddle with any iptables rules.

--
Kind Regards
AndrewM

Andrew McGlashan
Broadband Solutions now including VoIP


_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

<Prev in Thread] Current Thread [Next in Thread>