This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-users] antispoof with Xen 3

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-users] antispoof with Xen 3
From: "Dirk H. Schulz" <dirk.schulz@xxxxxxxxxxxxx>
Date: Tue, 19 Sep 2006 10:32:28 +0200
Delivery-date: Tue, 19 Sep 2006 01:33:16 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla Thunderbird 1.0.7 (Macintosh/20050923)
Hi folks,

I am trying to get antispoofing running on xen3 (based on Debian Sarge). This is what I have done to enable it:

1. I have compiled a dom0 kernel with CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
2. I made sure this module is loaded: lsmod gives xt_physdev (among others). 3a. I have changed the line "(network-script network-bridge)" to "(network-script network-bridge antispoof=yes)" in /etc/xen/xend-config.sxp. 3b. I have also tried setting the default in network-bridge to yes by changing the antispoof line to "antispoof:${antispoof:-yes}".

Then I have setup a domU with vif=['mac=ae:00:00:78:be:04, ip='], but "inside" I have configured the ip address of eth0 to be After starting the domU "ifconfig eth0" shows the ip address, but the domU still has network access to the outside.

That means: antispoofing does not work.

I have googled a lot but found nothing I did not try. Does antispoofing in Xen3 not work with the new CONFIG_NETFILTER_XT_MATCH_PHYSDEV of kernel 2.6.16? Or is there anything else I have overlooked.

Any hint or help is appreciated.


Xen-users mailing list

<Prev in Thread] Current Thread [Next in Thread>