* Virtual Firewall [not found] <1746047153.230756.1363271967103.JavaMail.root@innovot.com> @ 2013-03-14 14:53 ` Phil Daws 2013-03-14 15:30 ` Andrew Cathrow 0 siblings, 1 reply; 3+ messages in thread From: Phil Daws @ 2013-03-14 14:53 UTC (permalink / raw) To: kvm Hello, have been trying to build a virtual firewall as a POC but having some difficulty with the networking aspect. On the physical server I have a single NIC that is connected to the Internet with the IP XXX.XXX.XXX.10 and is bound to bridge0. I created the first guest, as the firewall, and added a virtio interface with source type "Host device vnet (bridge0)". At the guest OS level I assigned the NIC another public IP XXX.XXX.XXX.20 and was able to route quite happily to the Internet. I then proceeded to add a second NIC to the firewall guest but this time using the default NAT network and gave it the address 192.168.1.1. I then created another guest with the IP 192.168.1.2 with its default route being 192.168.1.1 and that could get out to the Internet as-well once the FORWARD+SNAT rules w ere added to iptables. Now here in lies the problem. I wish to add another network so that I end up with: XXX.XXX.XXX.20 Public Facing 192.168.1.1 Private LAN 192.168.2.1 DMZ So using virtual-manager I created two brand new networks called "PrivateLAN" and "DMZ" with the networks above. I then removed the secondary interface from the firewall and added two new NICs, one being on the PrivateLAN and the other on the DMZ. When I fired up the firewall and attempted to assign those IP addresses to the interfaces the response was: [root@fw1 ~]# ifup eth1 Error, some other host already uses address 192.168.1.1. [root@fw1 ~]# ifup eth2 Error, some other host already uses address 192.168.2.1. Running an arping showed that the MAC for bridge0 already had those IPs registered ?!?!? I am obviously missing a networking fundamental here and really would like some help. If you have only one physical NIC how do you create multiple networks as above; that allows IPtables to control the traffic flow. Any help gratefully appreciated. Thanks. ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Virtual Firewall 2013-03-14 14:53 ` Virtual Firewall Phil Daws @ 2013-03-14 15:30 ` Andrew Cathrow 2013-03-14 15:52 ` Phil Daws 0 siblings, 1 reply; 3+ messages in thread From: Andrew Cathrow @ 2013-03-14 15:30 UTC (permalink / raw) To: Phil Daws; +Cc: kvm ----- Original Message ----- > From: "Phil Daws" <uxbod@splatnix.net> > To: kvm@vger.kernel.org > Sent: Thursday, March 14, 2013 10:53:43 AM > Subject: Virtual Firewall > > Hello, > > have been trying to build a virtual firewall as a POC but having some > difficulty with the networking aspect. On the physical server I > have a single NIC that is connected to the Internet with the IP > XXX.XXX.XXX.10 and is bound to bridge0. I created the first guest, > as the firewall, and added a virtio interface with source type "Host > device vnet (bridge0)". At the guest OS level I assigned the NIC > another public IP XXX.XXX.XXX.20 and was able to route quite happily > to the Internet. I then proceeded to add a second NIC to the > firewall guest but this time using the default NAT network and gave > it the address 192.168.1.1. I then created another guest with the > IP 192.168.1.2 with its default route being 192.168.1.1 and that > could get out to the Internet as-well once the FORWARD+SNAT rules > were added to iptables. > > Now here in lies the problem. I wish to add another network so that > I end up with: > > XXX.XXX.XXX.20 Public Facing > 192.168.1.1 Private LAN > 192.168.2.1 DMZ > > So using virtual-manager I created two brand new networks called > "PrivateLAN" and "DMZ" with the networks above. I then removed the > secondary interface from the firewall and added two new NICs, one > being on the PrivateLAN and the other on the DMZ. When I fired up > the firewall and attempted to assign those IP addresses to the > interfaces the response was: > > [root@fw1 ~]# ifup eth1 > Error, some other host already uses address 192.168.1.1. > > [root@fw1 ~]# ifup eth2 > Error, some other host already uses address 192.168.2.1. > > Running an arping showed that the MAC for bridge0 already had those > IPs registered ?!?!? I am obviously missing a networking > fundamental here and really would like some help. > > If you have only one physical NIC how do you create multiple networks > as above; that allows IPtables to control the traffic flow. > > Any help gratefully appreciated. This is well supported in libvirt [1] If you don't want to use libvirt then you can at least run to test the rules that are created or look at the code. [1] http://libvirt.org/firewall.html > > Thanks. > -- > To unsubscribe from this list: send the line "unsubscribe kvm" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Virtual Firewall 2013-03-14 15:30 ` Andrew Cathrow @ 2013-03-14 15:52 ` Phil Daws 0 siblings, 0 replies; 3+ messages in thread From: Phil Daws @ 2013-03-14 15:52 UTC (permalink / raw) To: Andrew Cathrow; +Cc: kvm ----- Original Message ----- From: "Andrew Cathrow" <acathrow@redhat.com> To: "Phil Daws" <uxbod@splatnix.net> Cc: kvm@vger.kernel.org Sent: Thursday, 14 March, 2013 3:30:50 PM Subject: Re: Virtual Firewall ----- Original Message ----- This is well supported in libvirt [1] If you don't want to use libvirt then you can at least run to test the rules that are created or look at the code. [1] http://libvirt.org/firewall.html > > Thanks. > -- > To unsubscribe from this list: send the line "unsubscribe kvm" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Thank you Andrew. I believe the underlying problem is my understanding of how KVM handles network interfaces. You have bridge, macvtap, nat etc. All I wish todo is to have one physical bridged network and X+ virtual networks that can route through a single guest. Is that impossible ? I don't think it is as I can do two networks with the default NAT. Thanks. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-03-14 15:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1746047153.230756.1363271967103.JavaMail.root@innovot.com>
2013-03-14 14:53 ` Virtual Firewall Phil Daws
2013-03-14 15:30 ` Andrew Cathrow
2013-03-14 15:52 ` Phil Daws
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox