snat in PREROUTING chain?

Hi all,

Apologies in advance if this is covered elsewhere, but I haven't yet  
found anything that seems to match what I'm trying to accomplish.

I'm working on a project that involves large numbers of Xen virtual  
machines, which need to be sandboxed network-wise into multiple  
private subnets. For efficient and minimally restrictive containment  
it seemed that using ebtables would be a good way to go. The idea is  
simply to map each VMs internal MAC address to one we allocate  
externally. We use some of the upper bits to represent a 'virtual  
network' identifier. Then we employ ebtables to ensure that each VM  
may only receive packets with source MAC addresses matching its  
virtual network.

However, we've run into a problem. Since ebtables only snats after the  
bridging code has seen the internal VM MAC address, the bridge is  
confused when two virtual machines with the same internal MAC address  
are enslaved on it. What we'd like is to change the MAC address before  
it comes out of the Xen vif and into the bridge, keeping whatever  
original internal address exists completely isolated. (This also  
permits us to have VMs with the same MAC address internally - a nicety  
since we're actually forking them!)

Is this possible already? Am I missing something? If not, should I  
investigate patching ebtables to allow snat in PREROUTING, or is there  
a good reason why this is not already done?

Thanks in advance,
Steve

P.S. Please CC me as I'm not subscribed to the list.


-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/