[Xen-devel] iptables filtering when bridging

[David <big.raiders.fan@xxxxxxxxx>]

Still sort of new to Xen, and have been playing around with it bridging ethernet traffic between Dom0 and DomU.  I'm trying to figure out how to have iptables filtering performed in Dom0 when bridging.

I've found some references to using the following command:
ebtables -t broute -A BROUTING -p ipv4 --ip-proto 6 --ip-dport 80 -j redirect --redirect-target ACCEPT

(For now, I just want to filter Web traffic).

Using the above rule, and logging the ebtables and iptables traffic, I see that traffic is going into the ebtables' Filter table's Input chain, but then I see no activity after that.  The Web browser in DomU never sees any packets.  Based on 
http://ebtables.sourceforge.net/br_fw_ia/PacketFlow.png, the packet appears to be going the right way, but I can't make it go any further.

Is it possible to have the packets go through the iptables Filter tables in Dom0?  What I'd eventually like to get to is running squid in Dom0 to proxy and filter Web traffic, but I cannot seem to get the traffic to flow properly when in bridging mode.  Based on other searches, I've tried (with squid configured and running in Dom0):

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128

This does not seem to work.  Any insight into how to get this working would be appreciated.
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel