Welcome Guest. Please Login or Register  


You are here: Index > Virtualizor - Virtual Server Control Panel > General Support > Topic : Rebuild Xen IPtables Without Restarting



Threaded Mode | Print  

 Rebuild Xen IPtables Without Restarting, How does one Rebuild Xen IPtables Without Restarting (1 Replies, Read 2796 times)
bitronictechnologies
Group: Member
Post Group: Newbie
Posts: 3
Status:
I am having an issue. I "reset" the firewall to "factory defaults" in virtualizor. It deleted all of the forwarding rules in my IPtables. If I stop and start a VM it adds the rules back. Does anybody know how to rebuild the IPtables with rules for all of  the VMs without rebooting my 2 servers with many, many clients on them?

Perhaps a variant of this:

Code
#!/bin/bash

xm list | perl -alne 'next if not $F[1] > 0 ; print "@F[0,1]"' | while read VM ID
do
  xm network-list $ID | perl -alne 'next if not $F[0] =~ m{^\d+$} ; print $F[0]' | while read IFID
  do
    VIF="vif$ID.$IFID"
    echo iptables -A FORWARD -m physdev --physdev-in $VIF -s $VM -j ACCEPT
    echo iptables -A FORWARD -m physdev --physdev-in $VIF -p udp --sport bootpc --dport bootps -j ACCEPT
  done
done
IP: --   

Rebuild Xen IPtables Without Restarting
bitronictechnologies
Group: Member
Post Group: Newbie
Posts: 3
Status:
By the way the whole reason that I had to reset the IP tables was because I could not traceroute any of my servers. Now I see why. The Virtulizor strikes again.

I guess after the latest update when you rebuild a VM with multiple IPs you end up with iptables like this:

Code
Chain FORWARD (policy ACCEPT)
target    prot opt source              destination
ACCEPT    all  --  anywhere            anywhere            PHYSDEV match --physdev-in eth0 ! --physdev-out eth0
ACCEPT    all  --  anywhere            anywhere            PHYSDEV match ! --physdev-in eth0 --physdev-out eth0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  powerhub.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  cloudone.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    all  --  powerhub.bitronictech.net  anywhere            PHYSDEV match --physdev-in vif1101.0
ACCEPT    udp  --  anywhere            anywhere            PHYSDEV match --physdev-in vif1101.0 udp spt:bootpc dpt:bootps


Obviously a problem. It is getting the hostname instead of the IP, which is screwing the hell out of all the packet routing.

I'll be opening a ticket and referencing this forum. This needs to be patched immediately.
IP: --   

« Previous    Next »

Threaded Mode | Print  



Jump To :


Users viewing this topic
1 guests, 0 users.


All times are GMT. The time now is May 23, 2024, 2:37 pm.

  Powered By AEF 1.0.8 © 2007-2008 Electron Inc.Queries: 10  |  Page Created In:0.028