From mboxrd@z Thu Jan  1 00:00:00 1970
From: Toens Bueker <toens.bueker@lists0903.nurfuerspam.neuroserve.org>
Subject: Re: NAT through Dom0 on unstable branch
Date: Tue, 21 Jun 2005 21:15:13 +0200
Message-ID: <20050621191513.GA5877@neteligent.de>
References: <fa8d26480506201140246713f7@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Return-path: <xen-devel-bounces@lists.xensource.com>
Content-Disposition: inline
In-Reply-To: <fa8d26480506201140246713f7@mail.gmail.com>
List-Unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: xen-devel@lists.xensource.com
List-Id: xen-devel@lists.xenproject.org

Eitan Isaacson <ee.jay.eye@gmail.com> wrote:

> These are the steps that I take (note, these steps worked fine in
> "testing" and "stable" branches):
>=20
> I first set up a bridge with a private IP:
>=20
> brctl addbr mybr0
> ip addr add 192.168.0.1/24 dev mybr0
> ip link set mybr0 up
>=20
> These are my network scripts in the xend config file:
>=20
> (network-script     network-route)
> (vif-script         vif-bridge)
> (vif-bridge         mybr0)
>=20
> I start a DomU with an IP of 192.168.0.101, and I am able to ping Dom0
> (192.186.0.1).
>=20
> I enable IP forwarding, and I set up NAT:
>=20
> sysctl -w net.ipv4.ip_forward=3D1  # (if not allready done by xend)
> iptables -t nat -A POSTROUTING -j MASQUERADE \
>   -o eth0 -s 192.168.0.1/24

An alternative solution would be:

iptables -t nat -F POSTROUTING
iptables -t nat -F PREROUTING
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.2.0/24 -j SNAT \=20
         --to-source <your.public.ip.address>

for incoming connections you could do some portforwarding:

iptables -t nat -A PREROUTING -i eth0 -d <your.public.ip.address> \=20
         -p tcp --dport 80 -j DNAT --to-dest <ip.address.of.domU>

by
T=F6ns
--=20
There is no safe distance.