Xen, bridge and multiple IPs on CentOS

Question

There's a new server that is assigned 5 IP addresses. I want to use Xen to run several VMs with various services.

This is my first attempt to install Xen, I use this tutorial as a guideline. Stuck in the very beginning: they talk about replacing a single ip on an eth0 with a bridge br0. My server has 5: eth1 and 4 aliases eth1:1 .. eth1:4.

How should the network config look like?

1. bridge that replaces eth1 completely, and then 4 aliases added to the bridge?
2. bridge can only replace a single IP out of the 5?

Pardon my lame questions, first time in this forest.

Answer 1

1 advice with xen, if you decide to use classic bridge (vs ovs), set it manually as the scripts didn't get it right for me at first (with the single nic being locked out)

something like this should get bridging to work:

auto lo br0
iface lo inet loopback

iface br0 inet static
        address 192.168.128.7
        netmask 255.255.255.128
        network 192.168.128.0
        broadcast 192.168.128.127
        gateway 192.168.128.126
        dns-nameservers 172.16.2.200
        bridge_ports eth1
        bridge_stp off
        bridge_fd 0
        #bridge_hello 2
        #bridge_maxage 12

iface eth1 inet manual

Now on every guest os you will get an 'eth0' interface (rfr. bridge_fd=0), if you assign a ip address to that interface, it will be on the br0 bridge and will be able to do everything like the host can, given the fact that nothing is blocking it (netfilter etc)

for completeness sake, then you edit /etc/sysctl.conf (assuming debian here,sry) and set this as it might be needed for your network

net.ipv4.conf.eth1.proxy_arp = 1
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

and do sysctl -p to commit them. This disables netfilter from intervening on the bridge. Alternatively you could use iptables to do this too. from top of my head, something like this (they might not all be needed), but since I don't use these, it's just to give an idea:

iptables -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
iptables -I FORWARD -m physdev --physdev-in vif1.0 -j ACCEPT

That vif1.0 (or perhaps named a bit different) interface will be shown once your guest os is started, you can check the network on the host with the classic tools (ip, ifconfig etc).

Answer 2

You need to: Get rid of the aliases eth1:1 through eth1:4, set up the bridge on your existing `eth1 interface, and then go on with life.