[ILUG] Debian / Xen / IPv6

[jez]

On Mon, Apr 23, 2007 at 04:57:05PM +0100, FRLinux wrote:
> 
> This is my first server with the following combination : Xen and IPv6.

Nice.

> The issue is that since Xen is running, IPv6 packets are not coming
> and leaving on the same interface (that's my theory).
> 
> Now, i need to keep IPv6 running on the Dom0 but not on any DomU
> boxes. My issue is that i get my IPv6 by router advertisement (and
> again, not something i want to change). So, i tried the following in
> /etc/sysctl.conf :
> 
> net.ipv6.conf.peth0.accept_ra=0
> net.ipv6.conf.xenbr0.accept_ra=0
> 
> After restart, both were back to 1 ...

peth0 and xenbr0 are not going to exist until the /etc/init.d/xend
script has run - so this sysctl configuration is too early to be useful.

I think you will find it a lot easier to manipulate xen networking into
doing what you want if you stop using xen's automatic network bridging and
set up your own bridge for xen to use from /etc/network/interfaces
instead. If you did this you would have a bridge interface (eg xbr0) 
that would take the place of that whole eth0, peth0, xenbr0 mess. You 
give eth0's address to the xbr0 and treat it like it was eth0 - real 
simple. I can give the 2 minute quickfit instructions on how to do this 
if you want. Might be more involved to set up if eth0 is getting an IPv4 
address via DHCP. Anyway, if your interested, post the eth0 entry in
your interfaces file and we'll work from there. Also good to know if you
are working locally or dangerously.

Also worth noting that as long as
/proc/sys/net/bridge/bridge-nf-call-ip6tables is "1" (the default), then 
you can use ip6tables to filter your bridge traffic. However, from a layer3
perspective, the bridge xenbr0 is a single logical interface. In order 
to distinguish between traffic coming or leaving on a particular physical 
interface (ie a bridge port like vif3, peth0, etc), you need to use the 
physdev module. Eg:

 ip6tables -A FORWARD -i vif3 ... -j ACCEPT   # Won't work as expected
 ip6tables -A FORWARD -m physdev --physdev-in vif3 -j ACCEPT   # Works

If you put your thinking cap on, you might be able to come up with 
a solution to your problem using this functionality. You can use 
'brctl show' to see what Xen has put on the bridge. I'd still advocate 
going with a /etc/network/interfaces setup over xen's auto-bridging
though.

jez