On Sat, Nov 08, 2003 at 04:20:59AM +0000, Torne Wuff wrote:
> On Sat, Nov 08 03 at 12:36:25AM +0000, Ian Pratt wrote:
> > > # run_iptables -t filter -F
> > > # run_iptables -t filter -X
> > >
> > > I can now run xen_nat_enable and it leaves my existing filter
> > > rules in place. The existing filter rules are extremely
> > > permissive.
> >
> > It's arguable that these 2 lines are a bug in the script...
>
> The flush/clear commands are to make the script idempotent; as long as
> you only run it once, and the actions it takes don't interact with your
> existing firewall, it'll be fine.
Sorry for the late follow-up, Torne.
I don't understand this - reality seems to the be opposite of what you
wrote. If you flush (-F) & delete (-X) all the existing filter rules
& chain, then it clearly *does* interact with the current firewall.
Since the script applies to NAT rules, not filter rules (the *nat
section, not the *filter section), I don't understand why you would
touch the filter rules at all. Flushing the existing *nat rules might
make sense, but I'm not so certain about that either.
It might be there is some variability in how different distributions
set up firewall rules, and I'm not an expert in iptables at all, so
apologies if this doesn't make sense.
> You would do better to add the NAT rules into the firewall setup itself,
> though, as this would get rid of any ordering problems..etc.
> xen_nat_enable, other than making assumptions for you about IP
> addresses, doesn't do anything Xen-specific.
Yes, this is clearly the way to go for a stable setup. You'd need to
have all the firewall rules in place at system boot time, assuming
that you'll also be booting non-0 Xen domains. But for
experimentation, people will try to use the existing tools.
-- Greg
-------------------------------------------------------
This SF.Net email sponsored by: ApacheCon 2003,
16-19 November in Las Vegas. Learn firsthand the latest
developments in Apache, PHP, Perl, XML, Java, MySQL,
WebDAV, and more! http://www.apachecon.com/
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel
|
Home