Re: Xen, ebtables and iptables problem

Grant,
    You were right; the problem was with the interface name. The
iptables rule is matching when I put the interface as xenbr0 (which is
the bridge). 

iptables -t nat -A PREROUTING -i xenbr0 -s 192.168.1.3 -p tcp --dport 80
-j REDIRECT --to-port 3128

But now I have another problem, I cannot see the packet being redirected
to 127.0.0.1. Actually, it is like the packet is lost. Maybe this is
because xen is handling the interfaces in some strange way.

                              Dom0
                            ---------------------------
                            |  Router2 192.168.1.2    |
                            |    00:16:41:55:A5:8C    |
                            |              eth0       |
               _________    |               |         |
              /         \   |   |-----------|------|  |
  192.168.1.1 | Network |   |   |        vif0.0    |  |
  Router1 ----|         |-------| peth0            |  |    Dom1
              \_________/   |   |            vif1.0------eth1 PC1
                            |   |__________________|  | 192.168.1.3
                            |       Xenbr0 bridge     |
                            ---------------------------

Anyway, I will try to do the same thing but using DNAT and redirecting
the packet to 192.168.1.2

Thanks,
Pablo

>-----Original Message-----
>From: ebtables-user-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
[mailto:ebtables-user-
>[email protected]] On Behalf Of Grant Taylor
>Sent: Thursday, September 27, 2007 6:27 PM
>To: Mail List - EBTables
>Cc: [email protected]
>Subject: Re: [Ebtables-user] Xen, ebtables and iptables problem
>
>On 09/27/07 15:41, Passera, Pablo R wrote:
>> Yes, I have it
>
>Ok.
>
>> Actually, the rule in the iptables is:
>>
>> iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.3 -p tcp --dport
>> 80 -j REDIRECT --to-port 3128
>
>Ok, that makes more sense.
>
>> 10.230.40.85 is incorrect.
>>
>> I am trying to redirect web pages requests generated by PC1 to the
>> port 3128 in Router2 (there is an squid there). So, the destination
>> IP would be "web page IP" and the source is 192.168.1.3
>
>Ok, I take it you are trying to do transparent proxying for PC1
>(192.168.1.3).  Correct?
>
>> Other thing that I've noticed is that if I drop every packet as
>> default policy in the PREROUTING chain (i.e. iptables -t nat -P
>> PREROUTING DROP), the packet is not sent. So, in some way the packet
>> is going through the PREROUTING chain, but I cannot catch it when the
>> target is REDIRECT. Does this tell you something else?
>
>Well keep in mind that the packet really came in to the system via eth1
>and passed through the EBTables and IPTables to end up at services
bound
>to eth0's IP of 192.168.1.2.  What if you take the in interface match
>out of the equation and just use the source IP, protocol, and
>destination port.
>
>> Thanks,
>
>No problem.
>
>
>
>Grant. . . .
>
>-----------------------------------------------------------------------
--
>This SF.net email is sponsored by: Microsoft
>Defy all challenges. Microsoft(R) Visual Studio 2005.
>http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>_______________________________________________
>Ebtables-user mailing list
>[email protected]
>https://lists.sourceforge.net/lists/listinfo/ebtables-user

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/