[Xen-users] confused: How to put packetfilter into domU and isolate dom0 completely?

[Carsten Aulbert <carsten@xxxxxxxxxxxxxxxx>]

Hi,

after two days of harvesting the web and the mailing list archive I am
completely lost and confused. The set-up I want to achieve is not that
complex, but killing me right now. I'll try to make the description as
short a possible:

I have set-up a small Ubuntu feisty Xen installation, I can create domU
via debootstrap and they are all running fine, especially with the
default xenbr0 every domU gets its IP via dhcp from the local network.
However, I want to reinstall everything "in the wild" with slightly
different needs.

I have got a single server with a single external IP. My dream is to
set-up a totally isolated dom0, where I can enter only via a remote
serial console or open ssh whenever there is need. Otherwise dom0 should
not do anything except managing the domUs. The remaining domU should be
dedicated to certain tasks (web, email, users, etc) and one domU (say
dom1) should do the firewalling, SNAT/DNAT stuff. Let me try some crude
aart:

Internet (public IP)
         |
        eth0(physical)
         |
       brextern?
         |
      dom1/eth0
         |
       brintern
         |
  +------+------+
  |      |      |
 dom2   dom3   dom0(from time to time)

My questions now are (if this piece of art is understandable):

Shall I
(1) Use two bridges (brextern, brintern) or
(2) delegate the physical interface to dom1

If (1)
right now I'm playing around with hard coded brctl/ip/ifup codes without
the fancy network-bridge script. My current problem is, eth0 is still
visible from dom0 and I cannot get rid off it. Maybe I'm stopped by not
understanding the peth0 and veth0 business here.
Anyone can tell me roughly how to achieve a solution here?

If (2)
How can I delegate the physical interface to dom1? I've looked around,
but only found pages where this is mentioned, but not done. Anyone can
give me the correct words to use in search engines? I've seen
pciback.hide for the dom0 kernel, but how can I make certain that the
filtering domU will get that card?

Thanks for any possible help, and sorry if I confuse you as well :)

Cheers

Carsten

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users