This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-users] vif-common.sh and iptables

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-users] vif-common.sh and iptables
From: Dmitry Nedospasov <dmitry@xxxxxxxxx>
Date: Tue, 26 Apr 2011 13:06:25 +0200
Delivery-date: Tue, 26 Apr 2011 04:07:43 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.21 (2010-09-15)
Hey everyone,

I have a question about vif-common.sh. I run multiple bridges attached
on dummy interfaces, which allow me to put guests in seperate subnets
(routed through the dom0). As you might expect I already have quite
extensive iptables scripts to accomidate this kind of routing.

I was just hoping someone on this list can confirm, that I understand
what the iptables lines in vif-common.sh actually do:

> iptables "$c" FORWARD -m physdev --physdev-in "$vif" "$@" -j ACCEPT \
>   2>/dev/null &&
> iptables "$c" FORWARD -m state --state RELATED,ESTABLISHED -m physdev
> \
>   --physdev-out "$vif" -j ACCEPT 2>/dev/null

>From what i can tell the goal of these lines is to allow networking even
if the default FORWARD policy is DENY, am I right? Is there any
additional side-effect if I comment these lines out in vim-common.sh,
that I'm not considering?


Dmitry Nedospasov <dmitry@xxxxxxxxx> -- Twitter: @nedos
Web: http://nedos.net -- Github: http://github.com/nedos

Xen-users mailing list

<Prev in Thread] Current Thread [Next in Thread>