Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having a problem with Xen where all outbound traffic from domU's are showing up as if it was coming from the dom0. Traffic passes both ways without a problem. I do not have NAT enabled. I am using bridging network mode.

Any ideas on how to troubleshoot this issue, or what the problem might be?

share|improve this question
    
What is the application or method you use for examine traffic? –  dchirikov Jan 13 '13 at 22:34
    
I've been trying with tcpdump, from the dom0. –  user98651 Jan 13 '13 at 22:43
    
I can see evidence of the problem by looking at the connected "FROM" address in SSH, or by reviewing HTTP logs after using wget from the domU (just two random examples). It shows as if the dom0 was the source. My iptables is completely empty but is there any way the MASQUERADE option is turn on? –  user98651 Jan 13 '13 at 23:09
add comment

1 Answer

up vote 0 down vote accepted

I figured it out! Turns out there was, in fact, POSTROUTING options in place through iptables. Deleting them quickly settled the issue, and all source addresses appear as they should. I thought I cleared out everything by using iptables -F and then service iptables save (to save my configuration changes). However the rules did not show up when using the command iptables -L. That showed no rules.

For whatever reason, using service iptables status displayed everything. Maybe someone can help explain the difference there.

share|improve this answer
    
The nat table is not shown by default; you have to request it specifically when you list your firewall rules. –  Michael Hampton Jan 13 '13 at 23:16
    
Got it. Any idea why using iptables -F did not clear them? Same reason? –  user98651 Jan 13 '13 at 23:17
    
Probably the same reason. –  Michael Hampton Jan 13 '13 at 23:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.