Re: howto set up a virtual firewall?

[Kurt Neufeld <kneufeld@burgundywall.com>]

Avi Kivity wrote:
> 
> Assuming you have eth0 on the host, tap0 on the host visible as eth0 in 
> the guest, and tap1 in the host visible as eth1 in the guest, you can 
> add a bridge between eth0 and tap0, and use tap1 as the nic in the host 
> for IP (e.g. run 'dhclient tap1' to obtain an internal IP address).

It turns out I did have everything correctly configured but it still 
doesn't work. The problem is that I cannot get a DHCP address on my vm.

I can see the DHCP Request packets going out and can see the Replies 
getting back to my physical card that I'm running tcpdump on. But for 
some reason the vm doesn't get/see them. The host has no iptables rules, 
all policies set to ACCEPT (yikes!).

I even tried 'echo 1 > /proc/sys/net/ipv4/conf/*/bootp_relay' but that 
didn't help.

If I configure the vm nic with a static address (the one that my host 
just gave up) then I can surf the net, even forward packets from my host 
machine that no longer has a public ip address. Unfortunately that is 
not an acceptable long term solution.

Some general questions, should br0 be up or down? What should my vm MAC 
be? The same as my physical card (peth) which is also the same as the 
bridge (br0)? The vnet0 does not match. (output later)

Somewhat related, I setup my internal nic as a bridge as well, but I 
can't get the vm to get a dhcp address there either. Can one member of a 
bridge get a dhcp address from another member of the bridge?

I'm running fedora 8 with kernel 2.6.23.15-137.fc8 if that makes any 
difference.

[root@xavier ~]
# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.0050047fb5a3       no              peth0
                                                         vnet0
br1             8000.001617d8fc32       no              peth1
                                                         vnet1

br0 is external
br1 is internal

[root@xavier ~]
# ifconfig |grep HWaddr
br0       Link encap:Ethernet  HWaddr 00:50:04:7F:B5:A3
br1       Link encap:Ethernet  HWaddr 00:16:17:D8:FC:32
peth0     Link encap:Ethernet  HWaddr 00:50:04:7F:B5:A3
peth1     Link encap:Ethernet  HWaddr 00:16:17:D8:FC:32
vnet0     Link encap:Ethernet  HWaddr 00:FF:79:58:28:0F
vnet1     Link encap:Ethernet  HWaddr 00:FF:DB:40:5D:D2


Thanks for the replies, please keep them coming!

Kurt

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/