I have currently a Xen on a debian wheezy dom0. I have 6 (public) ips and I would like to setup 6 VMs (each using one IP).

To keep access to dom0, I'd like dom0 ssh to bind on one IP port (lets say 4444). I don't really know where to start. Any pointers ?

  • 1
    It's best if you get seven IP addresses here. – Michael Hampton Feb 1 '14 at 16:10
  • 1
    Sure, but I would like to stick with 6. – NoWiS Feb 1 '14 at 16:14

So, I finally came up with a solution that I will details :

In this exemple, we have one physical network interface (eth0), 3 IPs and 3 VMs :

  • a.a.a.a (that will be shared by dom0 and one domU called VM_A)
  • b.b.b.b (for one domU VM_B)
  • b.b.b.c (for one domU VM_C)

dom0 /etc/network/interface:

auto xenbr0 
iface xenbr0 inet static
    bridge_ports eth0
    address a.a.a.a
    network a.a.a.0
    broadcast a.a.a.255
    gateway a.a.a.254

The default vif script used in /etc/xen/xend-config.sx will be (vif-script vif-bridge). This is for VM_B and VM_C which have their own ip.

For the configuration script of VM_B and VM_C (/etc/xen/VM_[BC].cfg) we will have :

vif = [ 'ip=b.b.b.b,mac=XX:XX:XX:XX:XX:XX' ]

For the configuration script of VM_A (/etc/xen/VM_A.cfg) we will have :

vif = [ 'ip=,script=vif-nat']

We have to add iptables rules in order to make VM_A visible to Internet :

iptables -t nat -A POSTROUTING -s -o xenbr0  -j MASQUERADE
# One rule for each port that need to be forwarded to `VM_A`
iptables -t nat -A PREROUTING -p tcp -d a.a.a.a --dport 22 -j DNAT --to
iptables -t nat -A PREROUTING -p tcp -d a.a.a.a --dport 80 -j DNAT --to

Also need to enable packet forwarding (/etc/sysctl.conf):


And finally here is how the /etc/network/interfaces of VM_A looks like :

 # The loopback network interface
 auto lo
 iface lo inet loopback

 # 'Fake' loopback interfaces (was needed in my case for some applications)
 auto lo:1
 iface lo:1 inet static
  address a.a.a.a

 # The primary network interface
 auto eth0
 iface eth0 inet static

The gateway address is selected by the vif_script by adding 127 to the given address.

And a last thing for the communication between VM_A and the other VMs (however, don't ask me why...):

echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables
  • thanks for an excellent walk-thorugh! could you please what this line does: net.ipv4.conf.eth0.proxy_arp=1 – darwin Jun 24 '15 at 15:34
  • and could you please post the config of /etc/network/interfaces in VM_A? – darwin Jun 24 '15 at 16:36
  • 1
    I added the /etc/network/interfaces of VM_A. For the arp_proxy, I think it is for the bridged IPs, not quite sure though. – NoWiS Jun 25 '15 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.