On 24/02/2010 19:07, Olivier B. wrote:
So, the winner is "CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m".
If I don't compile at all this module, all works fine.
Any idea why this module seem to be incompatible with my setup ?
If I put "xt_physdev" in /etc/modprobe.d/blacklist, it also works.
So I suppose it's a bug in the debian bridge script.
If I don't blacklist the module, I only see this rule in FORWARD :
Chain FORWARD (policy ACCEPT 202 packets, 32632 bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- * * 0.0.0.0/0
0.0.0.0/0 PHYSDEV match --physdev-in vif5.0
And it doesn't start. I obtain "Error: Device 0 (vif) could not be
connected. Hotplug scripts not working." after 100 seconds.
But if I comment this four lines in /etc/xen/scripts/vif-common.sh,
FORWARD stay empty, and DomU starts.
> iptables "$c" FORWARD -m physdev --physdev-in "$vif" "$@" -j ACCEPT \
> 2>/dev/null &&
> iptables "$c" FORWARD -m state --state RELATED,ESTABLISHED -m physdev \
> --physdev-out "$vif" -j ACCEPT 2>/dev/null
Also, if I let the FORWARD rule and start the DomU, it wait until the
100 seconds timeout _OR_ I flush the FORWARD rules.
What is the role of this netfilter rule ? Without that it seems to work
well...
Olivier
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
Home