I have Xen setup with domUs, some of which are public-facing, and some are private. I have shorewall setup on the dom0 as my firewall. I don't think I have my bridges/interfaces/zones setup correctly. I'm relatively new to all of this and have done hours of Googling. Please advise what's wrong with my interfaces and/or shorewall config.
My dom0 /etc/network/interfaces looks like this:
auto eth0
iface eth0 inet static
address 25.20.10.245
netmask 255.255.255.248
network 25.20.10.240
broadcast 25.20.10.247
gateway 25.20.10.246
dns-nameservers 75.75.75.75
auto eth0:0
iface eth0:0 inet static
address 10.0.0.245
netmask 255.255.255.0
1 domU has a public IP (ex: 25.20.10.243) AND a private IP (10.0.0.240)
auto eth0
iface eth0 inet static
address 25.20.10.243
gateway 25.20.10.246
netmask 255.255.255.248
auto eth0:0
iface eth0:0 inet static
address 10.0.0.243
netmask 255.255.255.0
1 domU just has a private IP (10.0.0.6). I want this domU to be on the same network as the other public domU, but this one does not have access to the outside world.
auto eth0
iface eth0 inet static
address 10.0.0.6
netmask 255.255.255.0
gateway 10.0.0.245
I think shorewall is a factor b/c I can't ping outside from the public domUs if I turn it off. Below are the setting I've set for the shorewall files I touched.
# Shorewall version 4 - Interfaces File
#ZONE INTERFACE BROADCAST OPTIONS
net eth0
dmz vif+ - routeback
# Shorewall version 4 - Zones File
fw firewall # domain 0
net ipv4 # local LAN and beyond
dmz ipv4 # servers running in domains other than 0
# Shorewall version 4 - Rules File
ACCEPT net $FW:25.20.10.245 tcp 22
ACCEPT net $FW:25.20.10.243 tcp 22,25,80,443
ACCEPT net $FW:25.20.10.244 tcp 22,25,80,443
# Shorewall version 4 - Policy File
fw dmz ACCEPT
dmz net ACCEPT
dmz fw DROP info
