Re: [Xen-users] firewall xenU woes (help would be appreciated)

["Dirk H. Schulz" <dirk.schulz@xxxxxxxxxxxxx>]

Adam Tworkowski schrieb:

> Hi,
>
> Could someone please help me out with networking my firewall on xenU
> configuration.  I have combed the list archives for posts on similar
> configurations and getting bridging working properly but I am stuck and
> generally confused.  I am trying to achieve the scenario below (ascii
> borrowed from previous thread).
>
>               +------------------------+
>               | physical machine, dom0 |
>               |   +---------------+    |
> -- Internet -------+ Firewall domU +--------- Intranet
>               |   +------+--------+    |
>               |          |             |
>               |          |   DMZ       |
>               |    +-----+------+      |
>               |    |            |      |
>               | +--+--+      +--+--+   |
>               | |domU1|      |domU2|   |
>               | +-----+      +-----+   |
>               +------------------------+
>
> So far:
>
> - physical ethernet device (will be two later) hidden from dom0 (no issue) 
> - domU (fw) using ethernet device -- has access to internet on eth0 (no issue)
> - domU1 and domU2 can only see domU when using bridge=xen-br0 although it 
> appears that only on of the two can be active as if both are pinging domU there 
> is much
> packet.  Using vif = ['mac=xx.xx..., bridge=xen-br0'"].
>
> Should domU1 and domU2 should be using xen-br0 at all or should this only be 
> for domU and the former be using xen-br1 and xen-br2 respectively.
>
> - I have attempted to have domU1 use vif = ['backend=fw'] without success
>
> - I have also attempted to created xen-br1,xen-br2 and have the non-fw domUs 
> use these: vif = ['bridge=xen-br1']
>  
I am  using a similar design (in my case the firewall still is in dom0, 
but that should not make a principal difference). I set up a separate 
bridge for every domU and connected each domU to its bridge.
The firewall sees every bridge as the gateway to an internal subnet (so 
every domU is an additional Intranet seen from the perspektive of the 
firewall). Now you only have to set up filter roules for iptables to 
allow/disallow connections between domUs and domU/Internet etc.
Hope that helps.

Dirk

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users