On Sat, Apr 11, 2009 at 6:34 PM, Eljas Alakulppi <Buzer@xxxxxxxxx
<mailto:Buzer@xxxxxxxxx>> wrote:
Like I said before, Xen doesn't add DROP rules by default, only
ACCEPT (so you need to set policy to DROP. Tho, it does seem like
seting antispoof=on should take care of setting policy to DROP on at
least Debian. Maybe your firewall script starts after Xen takes care
of networking? I have never used Xen on CentOS, so I'm not too sure
about it's specific details).
Regarding the fact that there is no IP specifed on the ACCEPT rule,
what does your iptables commands in the vif script look like?
Oh, and I assume you want to remove state match from the first rule
(otherwise the virtual servers will not allow any new connections) &
remove the second rule (allows all traffic orginating from
192.168.122.0/24 <http://192.168.122.0/24>. If there is no other
match requirements, it will allow DomUs to spoof addresses from
192.168.122.0/24 <http://192.168.122.0/24>). The third FORWARD rule
seems like everything gets ACCEPT'ed there. Also, please use
iptables-save, iptables -L doesn't include all of the details (like
-i and -o).
So, to wrap it up, the iptables-save should look something like:
*filter
...
:FORWARD DROP [0:0]
...
-A FORWARD -d 192.168.122.0/24 <http://192.168.122.0/24> -j ACCEPT
#Tho, this allows spoofing between two DomUs. You could try adding
-m physdev --physdev-in eth0 or whatever your external interface is
...
And once you start, there should be one more rule on FORWARD chain
-A FORWARD -s 192.168.122.5/32 <http://192.168.122.5/32> -m physdev
--physdev-in vif6.0 -j ACCEPT #or whatever the IP and vif happend to be
-Eljas Alakulppi
On Sat, 11 Apr 2009 14:47:45 +0300, Anand Gupta <xen.mails@xxxxxxxxx
<mailto:xen.mails@xxxxxxxxx>> wrote:
I tried to use the antispoof feature thinking it should do the
trick.
Modified /etc/xen/xend-config.sxp and modified it as follows:
(network-script 'network-bridge antispoof=yes')
Restarted, xen, and then checked the iptables --list. I don't
see the DROP
rules added.
Here is iptables before start of domU
****************************************************************************************************************
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp
dpt:domain
ACCEPT tcp -- anywhere anywhere tcp
dpt:domain
ACCEPT udp -- anywhere anywhere udp
dpt:bootps
ACCEPT tcp -- anywhere anywhere tcp
dpt:bootps
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere 192.168.122.0/24
<http://192.168.122.0/24> state
RELATED,ESTABLISHED
ACCEPT all -- 192.168.122.0/24 <http://192.168.122.0/24>
anywhere
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere
reject-with
icmp-port-unreachable
REJECT all -- anywhere anywhere
reject-with
icmp-port-unreachable
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
****************************************************************************************************************
Here it is after domU was started
****************************************************************************************************************
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp
dpt:domain
ACCEPT tcp -- anywhere anywhere tcp
dpt:domain
ACCEPT udp -- anywhere anywhere udp
dpt:bootps
ACCEPT tcp -- anywhere anywhere tcp
dpt:bootps
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere 192.168.122.0/24
<http://192.168.122.0/24> state
RELATED,ESTABLISHED
ACCEPT all -- 192.168.122.0/24 <http://192.168.122.0/24>
anywhere
ACCEPT all -- anywhere anywhere
REJECT all -- anywhere anywhere
reject-with
icmp-port-unreachable
REJECT all -- anywhere anywhere
reject-with
icmp-port-unreachable
ACCEPT all -- anywhere anywhere
PHYSDEV match
--physdev-in vif6.0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
****************************************************************************************************************
The only difference between both the outputs is
ACCEPT all -- anywhere anywhere
PHYSDEV match
--physdev-in vif6.0
Any ideas why this is happening ?
P.S. : If i am wrong in thinking that the above will resolve the
problem of
users binding ips of their domU and using them, please correct me.
--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/
--
regards,
Anand Gupta
------------------------------------------------------------------------
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
Home