Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got some Xen hosts configured in bridged mode, whose VMs use public or private IPs:

Host #1

  • dom0: 3.3.3.71
  • dom1: 10.0.2.10
  • dom2: 3.3.3.85
  • dom3: 10.0.2.11

Host #2

  • dom0: 3.3.3.72
  • dom1: 3.3.3.86
  • dom2: 10.0.2.12
  • dom3: 10.0.2.13

Host #3

  • dom0: 3.3.3.73
  • dom1: 10.0.2.14
  • dom2: 10.0.2.15
  • dom3: 3.3.3.87

VMs with public IPs (3.3.3.*) are reachable from the Internet. VMs with private IPs are reachable from within each other, and this is a desired behaviour. However, they can't reach the Internet because there's no 10.0.2.1 gateway in the local subnet. How can I fix this?

One solution would be to configure one server with a 10.0.2.1 interface to act as a NAT. However I don't want any SPOF and I'd like each host to do its own NAT using the public IP address assigned to the dom0.

I believe this is just a matter of configuring iptables in the dom0's. If this is correct, how?

share|improve this question

2 Answers 2

I found the following solution. I'm still open to good alternatives and hints.

On each Xen host:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -m physdev --physdev-in vif5.0 -o eth0 \
    -j SNAT --to-source 3.3.3.71

On each domU having a private IP (10.0.2.*):

route add -net 3.3.3.0 netmask 255.255.255.0 dev eth0
route add default gw 3.3.3.71
route del default gw 10.0.2.1
share|improve this answer

Is there any reason why you don't connect the DomUs that need access to the internet to the internet-bridges?

If you don`t want that - connect one of your DomUs that are connected to the internet to the "private" bridges and install a proxy on then (squid). Contact that proxy...

I don*t think it is a good idea to connect a Dom0 to the internet - but you will have your reasons...

share|improve this answer
    
I'm not sure I understood your answer. Why are you talking about Squid? I'm not running web servers. How could I "connect the DomUs that need access to the internet to the internet-bridges" as you wrote? Can you explain that better? I just wanted all the domUs to be able to access the Internet, while only a part of them being reachable from the outside with a public IP. Dom0s have to be accessible from the outside so that I can manage everything remotely. –  Alessandro May 19 '11 at 8:57
    
squid is a proxy - so if you do not want to connect directly to the internet - go via that proxy. I guessed you wanted to connect to http/https services from your DomUs. As for the Bridging (you explained why you don`t want a direct access - ok): Currently you are using DomUs "single homed" - so each of the DomUs has only one network interface on one bridge. You could connect more interfaces of these DomUs to more bridges - if you like. –  Nils Jun 6 '11 at 20:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.