On Sun, 22 May 2011 00:05 +0200, "Pascal Hambourg" <pascal.mail@xxxxxxxxxxxxxxx> wrote: > netfilter@xxxxxxxxxxxxxx a écrit : > > On Sat, 21 May 2011 22:51 +0200, "Pascal Hambourg" > >> > >> How are the virtual machine network interfaces connected together ? > >> Did you create two separate virtual links ? > >> One explanation could be that all interfaces are connected to the same > >> virtual link, so traffic coming to the router could arrive at any of its > >> two interfaces. > > > > That's an interesting idea. I'm not sure how Parallels sets up the > > interfaces. > > How then do you know which interface of the router is connected to which > network ? I'm basing the router connections to the various networks by the IP addresses and network Addresses. When I say I don't know how Parallels sets up the interfaces I mean I do not know the underling code that they use. Using standard tools (ifconfig, route, traceroute etc) all seems normal. Sending a broadcast packet (good idea) from network B I see the packet show up at network A machine and on both interfaces of the firewall. I even see the packets show up on network A when the firewall/router is turned off. Both Net A and Net B are assigned IPs on two entirely different networks. Obviously, this is not the expected behavior. I assumed that when I created two virtual machines and assigned them entirely different IPs on different networks they would be isolated from each other and not be able to see traffic (broadcasts etc) from the other net. I will have to look at how the virtual machines are setup, maybe there is something I missed. It clearly does not function as I expected. My hope was to simulate real life different nets connected by the firewall/router. > > A quick test could be to send broadcast packets from A then B while > listening on all interfaces of the other machines with tcpdump or the > like. If you can see the broadcast packets on all interfaces then they > all are on the same network. > > > Right now I'm writing the FORWARD rules assuming that when the real > > hardware is in place it will function as I expect. I'm using -i eth0 > > and -o eth1 for new traffic originating from Network A going to B and > > -i eth1 and -o eth0 for new traffic originating from Network B to A. > > Based on my original diagram below. Does that sound reasonable? > > Sure. > -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
