WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] Network issues with SuSE firewall

To: "Gregory Newby" <newby@xxxxxxxx>
Subject: Re: [Xen-devel] Network issues with SuSE firewall
From: Ian Pratt <Ian.Pratt@xxxxxxxxxxxx>
Date: Fri, 07 Nov 2003 22:53:59 +0000
Cc: xen-devel@xxxxxxxxxxxxxxxxxxxxx, Ian.Pratt@xxxxxxxxxxxx
Delivery-date: Fri, 07 Nov 2003 22:55:14 +0000
Envelope-to: steven.hand@xxxxxxxxxxxx
In-reply-to: Your message of "Fri, 07 Nov 2003 13:35:29 -0900." <20031107223529.GA1119@xxxxxxxxxxxxxxxxxxx>
List-archive: <http://sourceforge.net/mailarchive/forum.php?forum=xen-devel>
List-help: <mailto:xen-devel-request@lists.sourceforge.net?subject=help>
List-id: List for Xen developers <xen-devel.lists.sourceforge.net>
List-post: <mailto:xen-devel@lists.sourceforge.net>
List-subscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=subscribe>
List-unsubscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=unsubscribe>
Sender: xen-devel-admin@xxxxxxxxxxxxxxxxxxxxx
> > I'm afraid I'm not entirely surprised that xen_nat_enable doesn't
> > play well with your firewall. 
> 
> I'll do a little more diagnosis in the future.  What I think
> happened, though, is that the NAT's nat* rules somehow discarded
> the filter* rules.  I was also getting some complaints about
> mangle* needing to load the iptables module, which was not found
> (this was when I was trying to re-add my default rules).

I fear the xen_nat_enable script basically does a 'flush all
rules' to start with. Someone who understands iptables better
should be able to fix this...

> 2) Hmmm -- this does not work.  Any quick guess what to try fixing?

> $ xenctl domain list
> id: 0 (Domain-0)
>   processor: 0
>   has cpu: true
>   state: 0 active
>   mcu advance: 10
>   total pages: 192000
> id: 2 (XenoLinux)
>   processor: 0
>   has cpu: false
>   state: 1 stopped
>   mcu advance: 10
>   total pages: 24576

Did you start a domain 1 that then exited? 

The IP address of you're currently running domain (id: 2) should
be 169.254.1.2

"state: 1 stopped" doesn't look good, though. Have you actually
"xenctl domain start"'ed the domain?

Ian


-------------------------------------------------------
This SF.Net email sponsored by: ApacheCon 2003,
16-19 November in Las Vegas. Learn firsthand the latest
developments in Apache, PHP, Perl, XML, Java, MySQL,
WebDAV, and more! http://www.apachecon.com/
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel