1

I have a Dom0 with a mixed configuration: bridged networking and NAT is set up. There is one NIC connected to the internet (& 3 more that are unused).

This is my interfaces file:

# The primary network interface
iface eth0 inet manual

auto xenbr0
iface xenbr0 inet static
    bridge_ports eth0
    address 83.149.69.150
    gateway 83.149.69.190
    netmask 255.255.255.192

iface xenbr0 inet6 static
    address 2001:1AF8:3100:A00A:21::0000
    netmask 64
    gateway 2001:1AF8:3100:A00A::1

This is a vif line from a xen config file of one of the VMs (domU):

vif = [ 'ip=83.149.69.154,mac=00:16:3E:5E:96:D7,script=vif-bridge,bridge=xenbr0', 'ip=172.16.1.20,mac=00:16:3E:5E:96:D8' ]

This results in two interfaces on the domU:

eth0      Link encap:Ethernet  HWaddr 00:16:3e:5e:96:d7  
          inet addr:83.149.69.154  Bcast:83.149.69.191  Mask:255.255.255.192
          inet6 addr: 2001:1af8:3100:a00a:21::4/64 Scope:Global
          inet6 addr: fe80::216:3eff:fe5e:96d7/64 Scope:Link
          [...]

eth1      Link encap:Ethernet  HWaddr 00:16:3e:5e:96:d8  
          inet addr:172.16.1.20  Bcast:172.16.255.255  Mask:255.255.0.0
          inet6 addr: fe80::216:3eff:fe5e:96d8/64 Scope:Link
          [...]

However, any connection made to those VMs, appears as if originating from the Dom0 (public) IP. I'm talking about connections to nginx, apache, ssh, openvpn, etc. The connecting client always is 83.149.69.150 (= reverse dns: aleph.rootspirit.com)

For example who: 

# who
root     pts/0        2014-06-14 14:47 (aleph.rootspirit.com)

or openvpn (check all the 83.149.69.150 addresses):

OpenVPN CLIENT LIST
Updated,Sat Jun 14 14:51:12 2014
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
broserv,83.149.69.150:49545,356124,137293,Sat Jun 14 14:13:26 2014
pi,83.149.69.150:56293,322082,214456,Sat Jun 14 14:13:35 2014
heartbeat,83.149.69.150:42122,549631,1264272,Sat Jun 14 14:13:26 2014
industry,83.149.69.150:37885,759137,365405,Sat Jun 14 14:13:06 2014

What is causing this odd behaviour?

Edit:

I have this in my iptables:

iptables -t nat -A POSTROUTING -o xenbr0 -j MASQUERADE

When I remove that line, it works fine:

# who
root     pts/0        2014-06-14 19:39 (213.219.144.38.adsl.dyn.edpnet.net)

However, my VMs that run over NAT only can no longer access the internet:

# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 3999ms

iptables:

aleph /etc # iptables -L -nv
Chain INPUT (policy ACCEPT 3321 packets, 5903K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 1677 packets, 117K bytes)
 pkts bytes target     prot opt in     out     source               destination         
14511 3725K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            PHYSDEV match --physdev-is-bridged
18653 3752K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 1887 packets, 4659K bytes)
 pkts bytes target     prot opt in     out     source               destination         
aleph /etc # iptables -t nat -L -nv
Chain PREROUTING (policy ACCEPT 1365 packets, 96941 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:12223 to:172.16.1.1:22
    2   124 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:25 to:172.16.1.1
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:53 to:172.16.1.1
  558 38901 DNAT       udp  --  *      *       0.0.0.0/0            83.149.69.128/26     udp dpt:53 to:172.16.1.1
    2   128 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:465 to:172.16.1.1
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:4950 to:172.16.1.1
    7   420 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:110 to:172.16.1.1
    2   104 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:143 to:172.16.1.1
   12   720 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:993 to:172.16.1.1
    4   208 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:995 to:172.16.1.1
    2   104 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:21 to:172.16.1.2
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:2121 to:172.16.1.2:21
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:20 to:172.16.1.2
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:4951 to:172.16.1.2
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpts:50000:51000 to:172.16.1.2
    5   300 DNAT       tcp  --  *      *       0.0.0.0/0            83.149.69.128/26     tcp dpt:12222 to:172.16.1.2:22

Chain INPUT (policy ACCEPT 48 packets, 2802 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 58 packets, 3688 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 637 packets, 43589 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1320 94863 MASQUERADE  all  --  *      xenbr0  0.0.0.0/0            0.0.0.0/0
Improve this question

1 Answer 1

Reset to default
0

This happens because your Dom0 doesn't have any interface for the private network.

You should have separate bridges for the internal and public IP addresses.

Something like this:

auto xenbr0
iface xenbr0 inet static
    bridge_ports eth0
    address 83.149.69.150
    gateway 83.149.69.190
    netmask 255.255.255.192

iface xenbr0 inet6 static
    address 2001:1AF8:3100:A00A:21::0000
    netmask 64
    gateway 2001:1AF8:3100:A00A::1

iface dummy0 inet manual

auto xenbr1
iface xenbr1 inet static
    bridge_ports dummy0
    address 172.16.1.19
    netmask 255.255.255.0

And then respectively in your domU config:

vif = [ 'ip=83.149.69.154,mac=00:16:3E:5E:96:D7,script=vif-bridge,bridge=xenbr0', 'ip=172.16.1.20,mac=00:16:3E:5E:96:D8,bridge=xenbr1' ]

This way your dom0 will have a separate IP address in both the internal network and the public network.

EDIT: In addition to the above configuration, use this NAT rule:

iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -o xenbr0 -j SNAT --to-source 83.149.69.150
Improve this answer
11
  • I've just tried this, but this didn't solve my problem. Mind you, that this is also happening on DomU's with only a public IP (not NAT'ted at all).
    – Tuinslak
    Jun 14, 2014 at 15:55
  • Edited my initial post; it's due to iptables.
    – Tuinslak
    Jun 14, 2014 at 18:16
  • It also doesn't help to run masquerading on xenbr1.
    – Tuinslak
    Jun 14, 2014 at 19:04
  • I read the original question too quickly, and this is a different thing. What is the complete output of iptables -t nat -nv?
    – Tero Kilkanen
    Jun 15, 2014 at 1:37
  • edited initial post with more details about iptables.
    – Tuinslak
    Jun 15, 2014 at 8:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .