Xen 3.2 physical bridging

Xen 3.2 physical bridging - Linux

This article was written for Xen 3.2, it was successful tested on debian lenny 5.0.3

I describe how to use multiple physical network cards associated to different bridges and Virtual VE (guests). By default Xen uses ony one bridge and physical NIC -> eth0

First step is to create a script that will create the bridges for your physical NICs.

/etc/xen/scripts/your-script

- eth0 is used for the Xen Dom0
- eth1 is used for VE1
- eth2 is used for VE2

#!/bin/sh
NETBR="/etc/xen/scripts/network-bridge"
$NETBR start bridge="eth1_br" vifnum=1 netdev="eth1"
$NETBR start bridge="eth2_br" vifnum=2 netdev="eth2"
exit 0

Don't forget to make it executable! chmod +x your-script

This script will be called from
/etc/xen/xend-config.sxp

put this line to it:

(network-script your-script)

and remove or comment it out

(vif-script vif-bridge)
(network-script network-dummy)

then you can configure the bridge for your VE (virtual-guest)
open your config /etc/xen/node1.cfg

and remove the standard bridge: vif = [ 'ip=192.168.1.101,mac=00:16:3E:71:0B:18' ]
add your new bridge: vif=['bridge=eth1_br']

No routing configuration is needed! fellow

With following commands you can check your bridging configuration:
brctl show

Output:

bridge name     bridge id               STP enabled     interfaces
eth1_br         8000.005004f500b6       no              peth1
                                                        vif2.0
eth2_br         8000.005004f4ff5c       no              peth2
                                                        vif3.0

Check the routing information
netstat -arn

Output:

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth1_br
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth2_br
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0

Q: WHY is it interesting to use this kind of configuration?
A: The traffic cannot be sniffed by Dom0, DomN or Dom2

Some reasons:
1. If you get some problems with your primary NIC eth0 your xen dom0 will not be available but your guests are still alive and can communicate

2.If somebody hack your Xen Dom0 nobody can sniff ALL traffic of the VE's, Guests

It is possible that this configuration will not work with older xen versions, your-script must be edited wassat

Have you any questions, please do not hesitate to contact me fellow

(Votes #: 2)

Views: 372 | Author: admin | Date: 5-01-2010, 21:58