vlan + bridge + xen + trunk

(xen is a virtual machine monitor, virtual machines in xen are called
domains)

I have the following configuration:

trunk = Ethernet interface (renamed from ethx)
trunk.2 = vlan2 on trunk
trunk.3 = vlan3 on trunk
trunk.4 = vlan4 on trunk

br0 = trunk + xen vif's for vlan1 (native)
br1 = trunk.2 + xen vif's for vlan2
br2 = trunk.3 + xen vif's for vlan3
br3 = trunk.4 + xen vif's for vlan4

with the following ebtables rule, this all works perfectly:
ebtables -t broute -A BROUTING -i trunk -p 802_1Q -j DROP

and I was happy.

But now I want to create a xen domain which receives all the vlans,
which work fine on br0 without the existing ebtables rule.

I can make it all work except for arps if I do this:
ebtables -t broute -A BROUTING -i trunk -d FE:FD:05:00:00:00 -j ACCEPT
(FE:FD:05:00:00:00 is the mac address of the virtual adapter in the xen
domain)

And arps work for the trunked interface, but I break them for all the
other vlan bridges if I do this:
ebtables -t broute -A BROUTING -i trunk -d FF:FF:FF:FF:FF:FF -j ACCEPT

and I can't figure out a way around it. The situation that doesn't work
is where a broadcast comes in on a non native vlan (eg 2). This
broadcast needs to travel out of the xen domain port on br0, and on the
other bridge.

I can't help thinking I'm doing something the wrong way around, and
making it all a bit harder than it needs to be... any suggestions?

Thanks

James
(not on the list. I'll read the archives but a cc to me would be
appreciated)



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642