| |
|
 |
|
 |
|
|
|
| |
|
|
xen-devel
RE: [Xen-devel] Anti-IP-spoofing blocks the wrong packets
As I recall, the script also attempts to insert a rule that matches on
--physdev-in vifX.Y and -srcaddr a.b.c.d, which should allow packets to
leave the host if the IP is as expected. If that rule isn't getting
inserted, it suggests that the script had been invoked without it
knowing the IP of the domain. (Bad error behaviour)
Ian
> With xen-unstable from 20050207, the anti-IP-spoofing measure
> does not
> work. It blocks packets from domU from leaving the host. This
> is because
> the following iptable was set up by the script on dom0:
>
> Chain FORWARD (policy DROP)
> target prot opt source destination
> ACCEPT all -- anywhere anywhere
> PHYSDEV match
> --physdev-in eth0
> ACCEPT all -- anywhere anywhere
> PHYSDEV match
> --physdev-in eth0
>
> (it is in there twice because I had the rule saved from last
> time, and the
> script doesn't detect duplicate rules.)
>
> Running:
>
> iptables -P FORWARD ACCEPT
>
> solved the problem.
>
> --
> Robin
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from
> real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxxxx
> https://lists.sourceforge.net/lists/listinfo/xen-devel
>
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&op=click
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel
|
|
|
| |
|
Home