From c3f4738768dfe031114544371efa4a4dd498f5e4 Mon Sep 17 00:00:00 2001 From: teastep Date: Sun, 19 Feb 2006 17:33:42 +0000 Subject: [PATCH] Updates to Xen docs git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@3502 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- Shorewall-docs2/Xen.xml | 54 ++++++++++++++++++------------------ Shorewall-docs2/XenMyWay.xml | 14 ++++++++-- 2 files changed, 38 insertions(+), 30 deletions(-) diff --git a/Shorewall-docs2/Xen.xml b/Shorewall-docs2/Xen.xml index efc752a6e..7bc82cf52 100644 --- a/Shorewall-docs2/Xen.xml +++ b/Shorewall-docs2/Xen.xml @@ -46,11 +46,13 @@ Xen refers to the virtual machines as Domains. Domains are numbered with the first domain - being domain 0, the second domain 1, and so on. Domain 0 is special - because that is the domain created when to machine is booted. Additional - domains are created using the xm create command from - within Domain 0. Additional domains can also be created automatically at - boot time by using the xendomains service. + being domain 0, the second domain 1, and so on. Domain 0 + (Dom0) is special because that is the domain + created when to machine is booted. Additional domains (called + DomU's) are created using the xm + create command from within Domain 0. Additional domains can also + be created automatically at boot time by using the + xendomains service. Xen virtualizes a network interface named eth0 @@ -58,16 +60,15 @@ xend and assumes that the host system has a single ethernet interface named eth0. - in each domain. In domain 0, Xen also creates a bridge + in each domain. In Dom0, Xen also creates a bridge (xenbr0) and a number of virtual interfaces as shown in the following diagram. - I use the term Extended Domain 0 to - distinguish the bridge and virtual interfaces from domain 0 itself. That - distinction is important when we try to apply Shorewall in this - environment. + I use the term Extended Dom0 to distinguish + the bridge and virtual interfaces from Dom0 itself. That distinction is + important when we try to apply Shorewall in this environment. The bridge has a number of ports: @@ -90,25 +91,20 @@
- Configuring Shorewall in Domain 0 + Configuring Shorewall in Dom0 As I state in the answer to Shorewall FAQ 2, I object to running servers in a local zone because if the server becomes compromised then there is no protection between that compromised server and the other local systems. Xen allows me to safely run Internet-accessible servers in my local zone by creating a firewall in - (the Extended) Domain 0 to isolate the server(s) from the other local - systems (including Domain 0). + (the Extended) Dom0 to isolate the server(s) from the other local systems + (including Dom0). Here is an example. In this example, we will assume that the system is behind a second firewall that restricts incoming traffic so that we only have to worry about protecting the local lan from the systems running - in domains other than domain 0. - - - This is the real configuration which I - run at shorewall.net. - + in the DomU's.
/etc/shorewall/shorewall.conf @@ -125,13 +121,13 @@ /etc/shorewall/zones One thing strange about configuring Shorewall in this environment - is that Domain 0 is defined as two different zones. It is defined as the + is that Dom0 is defined as two different zones. It is defined as the firewall zone and it is also defined as "all systems connected to xenbr0:vif0.0. In this case, I call this second zone ursa (which is - the name given to the virtual system running in Domain 0); that zone - corresponds to Domain 0 as seen from the outside in the diagram above - (see more below). + the name given to the virtual system running in Dom0); that zone + corresponds to Dom0 as seen from the outside in the diagram above (see + more below).
# OPTIONS OPTIONS @@ -174,11 +170,11 @@ net xenbr0:peth0
Note that the net zone has two - different interfaces. From the point of view of Domain 0 (which is where + different interfaces. From the point of view of Dom0 (which is where Shorewall runs), the net zone comprises - everything except Domain 0. From the point of view of the Extended - Domain 0, the net zone is everything - connected (directly or indirectly) to the net zone is everything connected + (directly or indirectly) to the peth0 port on the bridge.
@@ -238,6 +234,10 @@ Ping/ACCEPT dmz ursa interface to xenbr0's vif0.0 port — it is the rules governing traffic to/from the ursa zone that protect the firewall in this configuration. + + More elaborate configurations are possible as described in my + Xen and the Art of Consolidation + article.
\ No newline at end of file diff --git a/Shorewall-docs2/XenMyWay.xml b/Shorewall-docs2/XenMyWay.xml index eba3807a1..614188a37 100644 --- a/Shorewall-docs2/XenMyWay.xml +++ b/Shorewall-docs2/XenMyWay.xml @@ -346,8 +346,16 @@ ACCEPT Wifi fw udp In the firewall DomU, I run a conventional three-interface firewall with Proxy ARP DMZ -- it is very similar to the firewall described in the - Shorewall Setup - Guide. + Shorewall Setup Guide. The + firewall runs a routed OpenVPN server to + provide roadwarrior access for our two laptops. Here is the firewall's + view of the network: + + + + The Shorewall configuration files are shown below. All routing and + secondary IP addresses are handled in the SuSE network + configuration.
/etc/shorewall/shorewall.conf: @@ -410,7 +418,7 @@ TCP_FLAGS_DISPOSITION=DROP fw firewall net ipv4 #Internet loc ipv4 #Local wired Zone -dmz:loc ipv4 #DMZ -- server running in virtual machine at 192.168.1.7 +dmz:loc ipv4 #DMZ -- server running in virtual machine at 206.124.146.177 vpn ipv4 #Open VPN clients #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE