On 06/23/08 11:00, Francois Goudal wrote:
I'm sorry, this is my mistake, you should replace xenbr0 by br2 in all
what I said, this is because I have done the setup again on another
machine and I didn't name everything exactly the same.
*nod*
Anyway, iptables-save returns :
# Generated by iptables-save v1.3.6 on Mon Jun 23 19:21:32 2008
*raw
:PREROUTING ACCEPT [38549:54443202]
:OUTPUT ACCEPT [21429:1190521]
COMMIT
# Completed on Mon Jun 23 19:21:32 2008
# Generated by iptables-save v1.3.6 on Mon Jun 23 19:21:32 2008
*nat
:PREROUTING ACCEPT [3560:445076]
:POSTROUTING ACCEPT [520:47639]
:OUTPUT ACCEPT [15:913]
-A POSTROUTING -o br2 -j MASQUERADE
COMMIT
# Completed on Mon Jun 23 19:21:32 2008
# Generated by iptables-save v1.3.6 on Mon Jun 23 19:21:32 2008
*filter
:INPUT ACCEPT [37185:54270101]
:FORWARD ACCEPT [3367:880373]
:OUTPUT ACCEPT [21464:1197423]
COMMIT
# Completed on Mon Jun 23 19:21:32 2008
Ok, there is nothing that is preventing things from working.
And as I said, I tried with -o eth0 directly as well, but this doesn't
work better.
Hum.
Actually this might be the case. I'm running a standard debian etch
kernel for the moment. I can consider building my own kernel, if
necessary. What is the kernel option I shouldn't enable ?
The option that I'm referring to is "CONFIG_BRIDGE_NETFILTER". This
option sets whether or not IPTables (layer 3 and above) sees bridged
(layer 2) traffic or not.
s/xenbr0/br2/ sorry :-)
*nod*
No, I was just confused sorry, I think this is the good interface actually.
Agreed.
Yes, I hope it will work at some point.
I will have a look to what you pointed regarding the option in the
kernel to have bridged packets not going through IPtables.
I don't see any thing in what you have presented that will make this be
a problem with the configuration that you have described.
Thanks :-)
*nod*
I don't see any thing that (in theory) should not work. The only thing
that comes to mind is to temporarily remove Host B (DomU) from the mix
and bridge br1 directly to eth1 and try your MASQUERADing between two
bridge interfaces.
The only other thing that comes to mind is that you may be trying to nat
existing connections, which can not be done because only the first
packet in the connection passes through the NAT table. But I don't
think this is likely.
Grant. . . .
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
