Package: xen-utils-common
Version: 3.2.0-2
Hello
We used the script network-bridge on our Xen servers based on etch
(xen-utils-common 3.0.3-0-2)
to setup bridge configuration. This script created a bridge xenbr0, renamed
eth0 to peth0,
renamed veth0 to eth0 and added peth0 and vif0.0 to the bridge.
For firewalling, we had to create rules to filter on xenbr0 (FORWARD) and
eth0 (INPUT/OUTPUT).
The resulting configuration is as follows:
peth0 -- Bridge xenbr0 -- vifx.x/eth0 (DomU)
^
|
v
vif0.0/eth0
Dom0
Since XEN 3.2, the script network-bridge creates a bridge eth0 instead of
xenbr0
and doesn't use vif0.0/veth0 anymore. That is, eth0 is now a bridge and
an interface
for Dom0 in one. This behaviour breaks our firewall rules.
The resulting configuration is as follows:
peth0 -- Bridge eth0 -- vifx.x/eth0 (DomU)
Dom0
vif0.0, veth0: not used
As work-around, we still use the scripts network-bridge and
xen-network-common.sh
from XEN 3.0 to get back the old behaviour.
For firewalling, we use Shorewall. The setup and rules required for Shorewall
are described at http://shorewall.net/4.2/XenMyWay.html. This setup assumes
there's a bridge xenbr0 and an interface eth0 for Dom0, that is, it assumes
the behaviour from XEN 3.0.
I think this change of configuration by the new scripts might break firewalling
rules of
other people, too. So there should be a way to re-activiate the old behaviour
of the scripts,
or get a smooth transition to the new way of configuration.
A similar problem is described in Bug #511579
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511579
And also here:
http://lists.xensource.com/archives/html/xen-users/2008-09/msg00261.html
https://systemausfall.org/wikis/howto/XenUpgrade3.2
Currently, we continue using the old network configuration scheme from XEN 3.0.
We might
consider to switch to the new configuration scheme in the future. We propose to
add
the old network-bridge scripts from XEN 3.0 as an alternative to the new
configuration
scheme (e. g. named network-bridge-3.0, xen-network-common-3.0.sh).
Regards,
Daniel Lutz
--
-- Daniel Lutz
-- Logintas AG, Sonnhaldenstrasse 87, CH-6331 Hünenberg, +41 41 783 21 21
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
