WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-users

Re: [Xen-users] iptables and state matches (established, related)

To: Marc Patino Gómez <mpatino@xxxxxxxxxxxx>
Subject: Re: [Xen-users] iptables and state matches (established, related)
From: "Daniel P. Berrange" <berrange@xxxxxxxxxx>
Date: Thu, 3 May 2007 12:17:56 +0100
Cc: John Hannfield <hal9020@xxxxxxxxx>, Tomas Lund <tlund@xxxxxx>, Andrey Oreshnikov <elride@xxxxxxxxx>, xen-users@xxxxxxxxxxxxxxxxxxx
Delivery-date: Thu, 03 May 2007 04:16:46 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <46398995.8040908@xxxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <c8749d500704100344n14cbf826x3cb70dc77373ce97@xxxxxxxxxxxxxx> <Pine.LNX.4.61.0704201317390.4846@xxxxxxxxxxx> <4d95b0990704280549i4827eaddmeec7a2b902259dd3@xxxxxxxxxxxxxx> <46398995.8040908@xxxxxxxxxxxx>
Reply-to: "Daniel P. Berrange" <berrange@xxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.4.1i
On Thu, May 03, 2007 at 09:04:53AM +0200, Marc Patino G?mez wrote:
> I have the same problem, and also
> 
> echo "0" >/proc/sys/net/bridge/bridge-nf-call-iptables
> 
> solves it. I don't known the reason, so I will read some doc about it.

Its a pretty confusing bit of iptables. Basically if you have that
setting at 0, then traffic going between 2 interfaces in a bridge
will not hit iptables. If you have it set to 1, then it'll have a
normal set of iptables rules applied. There are use cases for both
possible settings.

If you're using the regular network-bridge, with it set to zero 
you'll see 

Traffic: Guest -> Google
------------------------

Nada

Traffic: Guest -> Host
----------------------

Out:

NAT-PREROUTING  IN=eth1 OUT=     SRC=192.168.254.120 DST=192.168.254.132
INPUT           IN=eth1 OUT=     SRC=192.168.254.120 DST=192.168.254.132

Back:

OUTPUT          IN=     OUT=eth1 SRC=192.168.254.132 DST=192.168.254.120


Traffic: Host -> Guest
----------------------

Out:

NAT-OUTPUT      IN=     OUT=eth1 SRC=192.168.254.132 DST=192.168.254.120
OUTPUT          IN=     OUT=eth1 SRC=192.168.254.132 DST=192.168.254.120
NAT-POSTROUTING IN=     OUT=eth1 SRC=192.168.254.132 DST=192.168.254.120

Back:

INPUT           IN=eth1 OUT=     SRC=192.168.254.120 DST=192.168.254.132






Now with bridge-nf-call-iptables set to 1


Traffic: Guest -> Google
------------------------

Out:

NAT-PREROUTING  IN=xenbr1 OUT=       PHYSIN=vif2.0                
SRC=192.168.254.120 DST=64.233.167.99
FORWARD         IN=xenbr1 OUT=xenbr1 PHYSIN=vif2.0 PHYSOUT=peth1  
SRC=192.168.254.120 DST=64.233.167.99
NAT-POSTROUTING IN=       OUT=xenbr1 PHYSIN=vif2.0 PHYSOUT=peth1  
SRC=192.168.254.120 DST=64.233.167.99

Back:

FORWARD         IN=xenbr1 OUT=xenbr1 PHYSIN=peth1  PHYSOUT=vif2.0 
SRC=64.233.167.99   DST=192.168.254.120



Traffic: Guest -> Host
----------------------

Out:

NAT-PREROUTING  IN=xenbr1 OUT=       PHYSIN=vif2.0                
SRC=192.168.254.120 DST=192.168.254.132
FORWARD         IN=xenbr1 OUT=xenbr1 PHYSIN=vif2.0 PHYSOUT=vif0.1 
SRC=192.168.254.120 DST=192.168.254.132
NAT-POSTROUTING IN=       OUT=xenbr1 PHYSIN=vif2.0 PHYSOUT=vif0.1 
SRC=192.168.254.120 DST=192.168.254.132
INPUT           IN=eth1   OUT=                                    
SRC=192.168.254.120 DST=192.168.254.132

Back:

OUTPUT          IN=       OUT=eth1                                
SRC=192.168.254.132 DST=192.168.254.120
FORWARD         IN=xenbr1 OUT=xenbr1 PHYSIN=vif0.1 PHYSOUT=vif2.0 
SRC=192.168.254.132 DST=192.168.254.120


Traffic: Host -> Guest
----------------------

Out:

NAT-OUTPUT      IN=       OUT=eth1                                
SRC=192.168.254.132 DST=192.168.254.120
OUTPUT          IN=       OUT=eth1                                
SRC=192.168.254.132 DST=192.168.254.120
NAT-POSTROUTING IN=       OUT=eth1                                
SRC=192.168.254.132 DST=192.168.254.120
FORWARD         IN=xenbr1 OUT=xenbr1 PHYSIN=vif0.1 PHYSOUT=vif2.0 
SRC=192.168.254.132 DST=192.168.254.120

Back:

FORWARD         IN=xenbr1 OUT=xenbr1 PHYSIN=vif2.0 PHYSOUT=vif0.1 
SRC=192.168.254.120 DST=192.168.254.132
INPUT           IN=eth1   OUT=                                    
SRC=192.168.254.120 DST=192.168.254.132


So you're changing what set of iptables chains get traversed
by toggling that setting.

> John Hannfield wrote:
> >This is a known problem with Xen 3.0.x  and iptables connection tracking.
> >Connection tracking and state filtering only works as long as xen is
> >not running.
> >Try doing this:
> >
> >echo "0" >/proc/sys/net/bridge/bridge-nf-call-iptables
> >
> >That fixed it for me.

Dan.
-- 
|=- Red Hat, Engineering, Emerging Technologies, Boston.  +1 978 392 2496 -=|
|=-           Perl modules: http://search.cpan.org/~danberr/              -=|
|=-               Projects: http://freshmeat.net/~danielpb/               -=|
|=-  GnuPG: 7D3B9505   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505  -=| 

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

<Prev in Thread] Current Thread [Next in Thread>