From mboxrd@z Thu Jan 1 00:00:00 1970 From: Phil Daws Subject: Virtual Firewall Date: Thu, 14 Mar 2013 14:53:43 +0000 (GMT) Message-ID: <2015645203.231170.1363272823347.JavaMail.root@innovot.com> References: <1746047153.230756.1363271967103.JavaMail.root@innovot.com> Reply-To: Phil Daws Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit To: kvm@vger.kernel.org Return-path: Received: from mx1.dc1.innovot.com ([77.73.4.109]:35541 "EHLO mx1.dc1.innovot.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757763Ab3CNPC1 (ORCPT ); Thu, 14 Mar 2013 11:02:27 -0400 Received: from sm1.dc3.innovot.com (sm1.dc3.innovot.com [192.168.1.208]) by mx1.dc3.innovot.com (Postfix) with ESMTP id BEBCF40020 for ; Thu, 14 Mar 2013 14:53:52 +0000 (GMT) Received: from localhost ([127.0.0.1]) by sm1.dc3.innovot.com with SMTP ID 979 for ; Thu, 14 Mar 2013 14:53:51 +0000 (GMT) Received: from mx1.dc3.innovot.com (localhost [127.0.0.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.dc3.innovot.com (Postfix) with ESMTPS id C34A640020 for ; Thu, 14 Mar 2013 14:53:51 +0000 (GMT) Received: from wm1.dc3.innovot.com (unknown [192.168.1.221]) by mx1.dc3.innovot.com (Postfix) with ESMTP id 85F8740020 for ; Thu, 14 Mar 2013 14:53:47 +0000 (GMT) Received: from wm1.dc3.innovot.com (localhost.localdomain [127.0.0.1]) by wm1.dc3.innovot.com (Postfix) with ESMTP id 1F6E3C96DC for ; Thu, 14 Mar 2013 14:53:47 +0000 (GMT) Received: from wm1.dc3.innovot.com (wm1.dc3.innovot.com [192.168.1.221]) by wm1.dc3.innovot.com (Postfix) with ESMTP id E1360C96DB for ; Thu, 14 Mar 2013 14:53:45 +0000 (GMT) In-Reply-To: <1746047153.230756.1363271967103.JavaMail.root@innovot.com> Sender: kvm-owner@vger.kernel.org List-ID: Hello, have been trying to build a virtual firewall as a POC but having some difficulty with the networking aspect. On the physical server I have a single NIC that is connected to the Internet with the IP XXX.XXX.XXX.10 and is bound to bridge0. I created the first guest, as the firewall, and added a virtio interface with source type "Host device vnet (bridge0)". At the guest OS level I assigned the NIC another public IP XXX.XXX.XXX.20 and was able to route quite happily to the Internet. I then proceeded to add a second NIC to the firewall guest but this time using the default NAT network and gave it the address 192.168.1.1. I then created another guest with the IP 192.168.1.2 with its default route being 192.168.1.1 and that could get out to the Internet as-well once the FORWARD+SNAT rules w ere added to iptables. Now here in lies the problem. I wish to add another network so that I end up with: XXX.XXX.XXX.20 Public Facing 192.168.1.1 Private LAN 192.168.2.1 DMZ So using virtual-manager I created two brand new networks called "PrivateLAN" and "DMZ" with the networks above. I then removed the secondary interface from the firewall and added two new NICs, one being on the PrivateLAN and the other on the DMZ. When I fired up the firewall and attempted to assign those IP addresses to the interfaces the response was: [root@fw1 ~]# ifup eth1 Error, some other host already uses address 192.168.1.1. [root@fw1 ~]# ifup eth2 Error, some other host already uses address 192.168.2.1. Running an arping showed that the MAC for bridge0 already had those IPs registered ?!?!? I am obviously missing a networking fundamental here and really would like some help. If you have only one physical NIC how do you create multiple networks as above; that allows IPtables to control the traffic flow. Any help gratefully appreciated. Thanks.