This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] Re: nfsroot and brige

> > Instead use routing and iptables (masquerade) as follows:
> > dom0 eth0 stays with
> > dom0 eth1 stays with
> > dom0 acts as a NAT for unpriviledged domains
> that's what I was kind of figuring I would need to do.
> But a real bridge (I used to use them) would transparently bridge packets
> from vif1.0 to eth1, right? This is what I never saw working, unless I did
> things that made no sense (e.g. ifconfig xen-br0, and even
> then I only got from domU to dom0. (it makes no real sense to me for a
> *bridge* to have an IP address).
> I would expect something working as a real bridge to allow me to do this:
> ifconfig eth1
> brctl  xen-br0 addif eth1
> brctl  xen-br0 addif vif1.0

I am suprised that does not work. This is roughly what we are doing here. Let 
me just go through the steps you need to do to set up the bridge - maybe that 
will clarify something:

a) create the bridge:
brctl addbr xen-br0
ifconfig xen-br0 up

b) add the ip address of eth1 to the bridge (can also do it with ifconfig, but 
ip is easier to use):
ip addr add brd scope global dev xen-br0

c) setup routing:
route del -net eth1
route add -net xen-br0

d) add eth1 to the bridge:
brctl addif xen-br0 eth1

The above sets up the bridge, then upon domain creation:
e) add virtual interface to the bridge:
brctl addif xen-br0 vif1.0 
ifconfig vif1.0 up

That is all implemented in the two network scripts:

So if you decide not to use them make sure to have them disabled.

All that should allow your unpriviledged domains to appear as if they were 
connected to your local network (through a switch or whatever else).

In order to allow domU to access the internet you will have to:
a) set up routing on domU:
route add default gw

b) set dom0 to work as a NAT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Get back to me if that still does not work.

> This is essentially wiring the two ifs up to xen-br0.
> then I dhcp from domU and I would think packets ought to flow to
> vif1.0->eth1, and eth1->vif1.0, broadcasts would flow across the bridge
> transparently and, once the right MAC discovery happened, packets from
> vif1.0 would make it to
> I'm still not sure they didn't -- tcpdump seemed to think the DHCP
> requests were going to eth1, but my home router didn't seem to think it
> was seeing them. I will do a little more fooling around.
> ron


Quidquid latine dictum sit, altum viditur --- Anon

The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
Xen-devel mailing list