What is it about

The following short howto describes the setup of a xen installation with the following properties:

What is the problem?

Maybe you would like to accomplish the previously described setup by using dom0 as the routing firewall?

It could look like the following:
xen-network-not-working.png (dia source: xen-network-not-working.dia)

I tried hard to get this setup running, but a problem of iptables with the xen network bridge rendered this approach impossible.

What went wrong?


Root cause

Other reports

In the shorewall howtos you can find the following:

I know of no case where a user has successfully used NAT (including Masquerade) in a bridged Xen Dom0. So if you want to create a masquerading firewall/gateway using Xen, you need to do so in a DomU (see how I did it) or you must configure Xen to use routing  or NAT rather than the default bridging.


See: http://www.woitasen.com.ar/2011/09/confusion-using-iptables-nat-and-bridge/

How it can be done

The following picture describes a setup that avoids the previously described problem, since there are no bridges configured in dom1.

xen-network-two-bridges.png (dia source: xen-network-two-bridges.dia)

The configuration details (xen and shorewall configuration files) will follow soon ...


XenRoutingFirewall (last edited 2014-05-24 14:52:33 by anonymous)

Creative Commons Lizenzvertrag
This page is licensed under a Creative Commons Attribution-ShareAlike 2.5 License.