extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-22 14:20:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

More Xen documentation updates

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@4679 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2006-10-14 16:10:38 +00:00
parent dd23c12d4f
commit 1cf3baf8a8
2 changed files with 47 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
docs/Xen.xml
View File

@ -109,21 +109,23 @@
systems (including Dom0).</para> systems (including Dom0).</para>
<caution> <caution>
<para>I find Xen Domain 0 to be an arcane environment in which to try to <para>I find a bridged Xen Domain 0 to be an arcane environment in which
use Netfilter (and hence Shorewall). As the number of interfaces and to try to use Netfilter (and hence Shorewall). As the number of
bridges increase, complexity increases geometrically. I recommend interfaces and bridges increase, complexity increases geometrically. I
following this guide only if you really need to place a public server in recommend following this guide only if you really need to place a public
your local network. Otherwise, the <ulink url="XenMyWay.html">way that I server in your local network. Otherwise, <ulink
use Xen</ulink> is much more straight-forward.</para> url="XenMyWay.html">running Shorewall in a DomU</ulink> is much more
straight-forward as is <ulink url="XenMyWay-Routed.html">running
Shorewall in a routed Dom0</ulink>.</para>
</caution> </caution>
<warning> <warning>
<para>I know of no case where a user has successfully used NAT <para>I know of no case where a user has successfully used NAT
(including Masquerade) in a bridged Xen Dom0. So if you want to create a (including Masquerade) in a bridged Xen Dom0. So if you want to create a
masquerading firewall/gateway using Xen, you need to do so in a DomU masquerading firewall/gateway using Xen, you need to do so in a DomU
(see <ulink url="XenMyWay.html">how I do it</ulink>) or you must (see <ulink url="XenMyWay.html">how I did it</ulink>) or you must
configure Xen to use routing and NAT rather than the default configure <ulink url="XenMyWay-Routed.html">Xen to use routing</ulink>
bridging.</para> or NAT rather than the default bridging.</para>
</warning> </warning>
<para>Here is an example. In this example, we will assume that the system <para>Here is an example. In this example, we will assume that the system

61
docs/XenMyWay-Routed.xml
View File

@ -103,10 +103,6 @@
personal Linux desktop system and our Linux Laptop run personal Linux desktop system and our Linux Laptop run
<trademark>Ubuntu</trademark> "Dapper Drake".</para> <trademark>Ubuntu</trademark> "Dapper Drake".</para>
<para>If you are unfamiliar with Xen networking, I recommend that you read
the first section of the companion <ulink url="Xen.html">Xen and
Shorewall</ulink> article.</para>
<para>Here is a high-level diagram of our network.</para> <para>Here is a high-level diagram of our network.</para>
<graphic align="center" fileref="images/Xen5.png" /> <graphic align="center" fileref="images/Xen5.png" />
@ -139,14 +135,15 @@
<orderedlist> <orderedlist>
<listitem> <listitem>
<para>Dom0 (DNS name gateway.shorewall.net) is used as our main <para>Dom0 (DNS name <emphasis
role="bold">gateway.shorewall.net</emphasis>) is used as our main
firewall and wireless gateway as well as a local file server.</para> firewall and wireless gateway as well as a local file server.</para>
</listitem> </listitem>
<listitem> <listitem>
<para>The DomU (Dom name <emphasis role="bold">lists</emphasis>, DNS <para>The DomU (Domain name <emphasis role="bold">lists</emphasis>,
name lists.shorewall.net) is used as a public Web/FTP/Mail/DNS DNS name <emphasis role="bold">lists.shorewall.net</emphasis>) is used
server.</para> as a public Web/FTP/Mail/DNS server.</para>
</listitem> </listitem>
</orderedlist> </orderedlist>
@ -162,7 +159,7 @@
configuration like this one for your first Shorewall installation. You configuration like this one for your first Shorewall installation. You
are very likely to frustrate both yourself and the Shorewall support are very likely to frustrate both yourself and the Shorewall support
team. Rather I suggest that you start with something simple like a team. Rather I suggest that you start with something simple like a
<ulink url="standalone.htm">standalone installation</ulink> in a domU; <ulink url="standalone.htm">standalone installation</ulink> in a DomU;
once you are comfortable with that then you will be ready to try once you are comfortable with that then you will be ready to try
something more substantial.</para> something more substantial.</para>
@ -176,8 +173,8 @@
<section id="Domains"> <section id="Domains">
<title>Domain Configuration</title> <title>Domain Configuration</title>
<para>Below are the relevant configuration files for the three domains. <para>Below are the relevant configuration files for the two domains. I
I use partitions on my hard drives for DomU storage devices.</para> use a partition on my hard drives for the DomU storage device.</para>
<para>There is not much documentation about how to configure Xen for <para>There is not much documentation about how to configure Xen for
routed operation. I've tried to mark the relevant parts with <emphasis routed operation. I've tried to mark the relevant parts with <emphasis
@ -190,17 +187,23 @@
<blockquote> <blockquote>
<programlisting>title XEN <programlisting>title XEN
root (hd0,1) root (hd0,1)
kernel /boot/xen.gz dom0_mem=458752 sched=bvt kernel /boot/xen.gz Dom0_mem=458752 sched=bvt
module /boot/vmlinuz-xen root=/dev/hda2 vga=0x31a selinux=0 resume=/dev/hda1 splash=silent showopts module /boot/vmlinuz-xen root=/dev/hda2 vga=0x31a selinux=0 resume=/dev/hda1 splash=silent showopts
module /boot/initrd-xen</programlisting> module /boot/initrd-xen</programlisting>
</blockquote> </blockquote>
<para><filename>/etc/modprobe.conf.local</filename><blockquote> <para><filename>/etc/modprobe.conf.local</filename> (This may need to
go in <filename>/etc/modprobe.conf</filename> or
<filename>/etc/modprobe.d/options</filename> on your system)</para>
<para><blockquote>
<programlisting><emphasis role="bold">options netloop nloopbacks=0</emphasis> #Stop netloop from creating 8 useless vifs</programlisting> <programlisting><emphasis role="bold">options netloop nloopbacks=0</emphasis> #Stop netloop from creating 8 useless vifs</programlisting>
</blockquote></para> </blockquote></para>
<para><filename>/etc/xen/auto/02-lists</filename> — configuration file <para><filename>/etc/xen/auto/01-lists</filename> — configuration file
for the lists domain.</para> for the lists domain. Placed in <filename
class="directory">/etc/xen/auto/</filename> so it is started
automatically by Xen's <emphasis>xendomains</emphasis> service.</para>
<blockquote> <blockquote>
<programlisting># -*- mode: python; -*- <programlisting># -*- mode: python; -*-
@ -228,7 +231,7 @@ vif = [ 'mac=aa:cc:00:00:00:01, <emphasis role="bold">ip=206.124.146.177, v
disk = [ 'phy:hda3,hda3,w' ]</programlisting> disk = [ 'phy:hda3,hda3,w' ]</programlisting>
<para>Note that the vifname is set to 'eth3' for the virtual <para>Note that the vifname is set to 'eth3' for the virtual
interface to this domU. This will cause the dom0 interface to the interface to this DomU. This will cause the Dom0 interface to the
server to have a fixed name (<filename server to have a fixed name (<filename
class="devicefile">eth3</filename>) which makes it a lot easier to class="devicefile">eth3</filename>) which makes it a lot easier to
deal with in Shorewall and elsewhere.</para> deal with in Shorewall and elsewhere.</para>
@ -242,6 +245,12 @@ disk = [ 'phy:hda3,hda3,w' ]</programlisting>
206.124.146.177 scope link src 206.124.146.176 206.124.146.177 scope link src 206.124.146.176
gateway:~ #</programlisting> gateway:~ #</programlisting>
</blockquote> </blockquote>
<para>Note that the source for the route is 206.124.146.176. That is
the primary IP address of Dom0's <filename
class="devicefile">eth0</filename>. Xen configures <filename
class="devicefile">eth3</filename> to have that same IP address.
</para>
</blockquote> </blockquote>
<para>Excerpt from <para>Excerpt from
@ -281,11 +290,11 @@ gateway:~ #</programlisting>
<caution> <caution>
<para>Under some circumstances, UDP and/or TCP communication from a <para>Under some circumstances, UDP and/or TCP communication from a
domU won't work for no obvious reason. That happened with the DomU won't work for no obvious reason. That happened with the
<emphasis role="bold">lists</emphasis> domain in my setup. Looking at <emphasis role="bold">lists</emphasis> domain in my setup. Looking at
the IP traffic with <command>tcpdump -nvvi eth1</command> in dom0 the IP traffic with <command>tcpdump -nvvi eth1</command> in Dom0
showed that UDP packets from the <emphasis showed that UDP packets from the <emphasis
role="bold">lists</emphasis> domU had incorrect checksums. That role="bold">lists</emphasis> DomU had incorrect checksums. That
problem was corrected by arranging for the following command to be problem was corrected by arranging for the following command to be
executed in the <emphasis role="bold">lists</emphasis> domain when its executed in the <emphasis role="bold">lists</emphasis> domain when its
<filename class="devicefile">eth0</filename> device was brought <filename class="devicefile">eth0</filename> device was brought
@ -293,9 +302,9 @@ gateway:~ #</programlisting>
<para><command>ethtool -K eth0 tx off</command></para> <para><command>ethtool -K eth0 tx off</command></para>
<para>Under SuSE 10.1, I placed the following in <para>Under <trademark>SuSE</trademark> 10.1, I placed the following
<filename>/etc/sysconfig/network/if-up.d/resettx</filename> (that file in <filename>/etc/sysconfig/network/if-up.d/resettx</filename> (that
is executable):</para> file is executable):</para>
<programlisting>#!/bin/sh <programlisting>#!/bin/sh
@ -337,7 +346,7 @@ fi</programlisting>
wirelessly, the IP address is assigned by OpenVPN.</para> wirelessly, the IP address is assigned by OpenVPN.</para>
<para>The Shorewall configuration files are shown below. All routing and <para>The Shorewall configuration files are shown below. All routing and
secondary IP addresses are handled in the SUSE network secondary IP addresses are handled in the SuSE network
configuration.</para> configuration.</para>
<blockquote> <blockquote>
@ -768,8 +777,10 @@ $EXT_IF 30 6*full/10 6*full/10 3
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE</programlisting></para> #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE</programlisting></para>
</blockquote> </blockquote>
<para>The tap0 device used by the bridged OpenVPN server is created and <para>The <filename class="devicefile">tap0</filename> device used by
bridged to eth1 using a SuSE-specific SysV init script:</para> the bridged OpenVPN server is created and bridged to <filename
class="devicefile">eth1</filename> using a SuSE-specific SysV init
script:</para>
<blockquote> <blockquote>
<programlisting>#!/bin/sh <programlisting>#!/bin/sh