Sorry for the misconception, but we are not using the vif name in our rules.
There's one host configured with the ip adresses. (see /etc/shorewall/hosts)
/etc/shorewall/hosts
domu xenbr0:10.1.2.153,10.1.2.36,<more ips> routeback
The rules are using: domu:<ip> to firewall individual guests
ACCEPT all domu:10.1.2.153 tcp
80,443 # http/https
This setup worked apparently in older version on debian squeeze.
Does shorewall do an internal mapping of the vif names, maybe?
On 02/06/2014 12:40 PM, Simon Hobson wrote:
> Jan Hoersch <[email protected]> wrote:
>
>> During restart of the VM the vif gets removed and newly assigned to the
>> bridge. It seems something changed in enumerating the vif and the
>> iptable rules don't match up with the new vif.
>
> Yes, that's normal. The VM index increments each time a VM is started
- the first will be 1, the next 2, the next 3, and so on. Restart 1 and
it'll start up as whatever the previous highest number is +1 - AFAIK the
numbers are not reused, but I don't know what happens on a busy system
with lots of guests and/or lots of guest restarts.
>
> Thus you cannot rely on "vifx.y" to remain stable.
>
> One option is that you can specify a custom VIF name in the guest
config (I'm assuming you're running Xen). Eg :
> vif = [ 'bridge=br0,vifname=somespecialname' ]
> This will keep your VIF names consistent - but don't ever clone a
guest config and forget to change it - guess how I know what that does !
The VIF will still be removed and re-added if you stop and start the
guest (not too sure about a restart).
>
>
>
------------------------------------------------------------------------------
> Managing the Performance of Cloud-Based Applications
> Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
> Read the Whitepaper.
>
http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk
> _______________________________________________
> Shorewall-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/shorewall-users
------------------------------------------------------------------------------
Managing the Performance of Cloud-Based Applications
Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
Read the Whitepaper.
http://pubads.g.doubleclick.net/gampad/clk?id=121051231&iu=/4140/ostg.clktrk
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
