On Mon, Apr 23, 2007 at 04:57:05PM +0100, FRLinux wrote:
>> This is my first server with the following combination : Xen and IPv6.
> The issue is that since Xen is running, IPv6 packets are not coming
> and leaving on the same interface (that's my theory).
>> Now, i need to keep IPv6 running on the Dom0 but not on any DomU
> boxes. My issue is that i get my IPv6 by router advertisement (and
> again, not something i want to change). So, i tried the following in
> /etc/sysctl.conf :
>> After restart, both were back to 1 ...
peth0 and xenbr0 are not going to exist until the /etc/init.d/xend
script has run - so this sysctl configuration is too early to be useful.
I think you will find it a lot easier to manipulate xen networking into
doing what you want if you stop using xen's automatic network bridging and
set up your own bridge for xen to use from /etc/network/interfaces
instead. If you did this you would have a bridge interface (eg xbr0)
that would take the place of that whole eth0, peth0, xenbr0 mess. You
give eth0's address to the xbr0 and treat it like it was eth0 - real
simple. I can give the 2 minute quickfit instructions on how to do this
if you want. Might be more involved to set up if eth0 is getting an IPv4
address via DHCP. Anyway, if your interested, post the eth0 entry in
your interfaces file and we'll work from there. Also good to know if you
are working locally or dangerously.
Also worth noting that as long as
/proc/sys/net/bridge/bridge-nf-call-ip6tables is "1" (the default), then
you can use ip6tables to filter your bridge traffic. However, from a layer3
perspective, the bridge xenbr0 is a single logical interface. In order
to distinguish between traffic coming or leaving on a particular physical
interface (ie a bridge port like vif3, peth0, etc), you need to use the
physdev module. Eg:
ip6tables -A FORWARD -i vif3 ... -j ACCEPT # Won't work as expected
ip6tables -A FORWARD -m physdev --physdev-in vif3 -j ACCEPT # Works
If you put your thinking cap on, you might be able to come up with
a solution to your problem using this functionality. You can use
'brctl show' to see what Xen has put on the bridge. I'd still advocate
going with a /etc/network/interfaces setup over xen's auto-bridging
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!