Re: Xen, ebtables and iptables problem

On 09/27/07 11:04, Passera, Pablo R wrote:
> Hi all,
> 
> I have the following network configuration
>                              Dom0
>                            ---------------------------
>                            |  Router2 192.168.1.2    |
>                            |    00:16:41:55:A5:8C    |
>                            |              eth0       |
>               _________    |               |         |
>              /         \   |   |-----------|------|  |
>  192.168.1.1 | Network |   |   |        vif0.0    |  |
>  Router1 ----|         |-------| peth0            |  |    Dom1
>              \_________/   |   |            vif1.0------eth1 PC1
>                            |   |__________________|  | 192.168.1.3
>                            |       Xenbr0 bridge     |
>                            ---------------------------
> 
> PC1 default gateway is router1. The idea is to route PC1 packets 
> through router1 without modifying PC1 network configuration and 
> maintaining the bridged configuration also.

Ok...

> I have configured ebtables to redirect only http packets coming from 
> eth1 to eth0
> 
> ebtables -t nat -A PREROUTING -i vif1.0 -p ipv4 --ip-protocol 6 
> --ip-destination-port 80 -j dnat --to-destination 00:16:41:55:A5:8C

... ok ...

> Then I put the following iptables rule to redirect the packet to a 
> squid
> 
> iptables -t nat -A PREROUTING -i eth0 -s 10.230.40.85 -p tcp --dport 
> 80 -j REDIRECT --to-port 3128

... ok ...

> I am seeing the packet coming to eth0 interface with eth0 MAC address 
> and then the packet going out from eth0 with the router1 MAC address, 
> so I suppose that router2 is routing the packet. However, the 
> iptables rule is not working; the packet is not being redirected to 
> port 3128.

Hum.  If we change your statement to be "... so I suppose that router2 
is bridging the packet ..." I'll agree with you.

Do you have Bridge Net Filter option turned on in the kernel?  Bridged 
Net Filter allows IPTables to see bridged layer 2 traffic when it 
normally can not.  Normally IPTables will only see traffic that is 
destined to or originating from or being (layer 3) routed through the 
system.  As such with out Bridged Net Filter being enabled in the 
kernel, IPTables would never see the traffic that you are changing the 
destination MAC address on.

Now, with out knowing example source / destination IP addresses, I can't 
say for sure what will happen with the traffic when it reaches the 
system that it is redirected to.  So this in and of its self may still 
be a problem.  You have a 10.230.40.85 IP address listed in your 
IPTables rule, but I'm not sure where that system is and how it may or 
may not correlate to your IPTables rule.

> Does anyone know why this is happening? Since the packet is being 
> routed then it should go through the PREROUTING chain, doesn't it? 

I don't know for sure what is going on, but Bridged Net Filter is 
definitely something that I would look in to.

> Thanks in advance,

You are welcome.



Grant. . . .

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/