The Perfect Xen 3.0.3 Setup For Debian Sarge - Page 5

4.5 Create A Virtual Local Network From The Virtual Machines (Optional)

(This chapter is optional. What is described here works only if you installed Xen from the sources.)

In this chapter I want to create a virtual network with my virtual machines, i.e. a network that is different from the network of dom0.

You can find a drawing of what I want to do here:

I did the same with Xen 2.0.7 here: However, the way to achieve this with Xen 3 has changed completely. Xen 3 configures all the firewall rules, gateways, etc. automatically. Furthermore, we don't need any dummy network interface anymore for our virtual network. It is important to know that Xen 3 assigns gateways from the 10.x.x.x net to our virtual machines, so it is a good idea to also assign IP addresses from the 10.x.x.x net to our virtual machines. If you give them IP addresses from the 192.168.3.x net (as we did with Xen 2.0.7 on, then your virtual machines will have no access to the internet.

So we will give vm01 the IP address and vm02 the IP address

First we edit /etc/xen/xend-config.sxp and disable bridging and enable NAT (network address translation) instead:

vi /etc/xen/xend-config.sxp

#(network-script network-bridge)
#(vif-script vif-bridge)

(network-script network-nat)
(vif-script vif-nat)


Then we change the configuration files of vm01 and vm02:


vi /etc/xen/vm01-config.sxp


vif=[ 'ip=' ]



vi /etc/xen/vm02-config.sxp


vif=[ 'ip=' ]


Afterwards shut down vm01 and vm02:

xm shutdown vm01
xm shutdown vm02

Wait a few seconds and control with xm list that vm01 and vm02 have shut down. Then reboot the system:

shutdown -r now

If vm01 and vm02 aren't started automatically at boot time, start them now:

xm create /etc/xen/vm01-config.sxp
xm create /etc/xen/vm02-config.sxp

Now you should be able to ping vm02 from vm01 and vice versa, and you also be able to ping dom0 and hosts on the internet!

Now let's assume we have a web server on port 80 in vm01 and a mail server on port 25 in vm02. As they are in their own network (10.x.x.x), we cannot access them from the outside unless we forward these ports to the appropriate vm. We can create the necessary port forwarding rules on dom0 with the help of iptables:

iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 80 -j DNAT --to
iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 25 -j DNAT --to

If we connect to dom0 now on port 80, we are forwarded to vm01. The same goes for port 25 and vm02.

Of course, the forwarding rules are lost when we reboot dom0. Therefore we put the rules into /etc/network/if-up.d/iptables, which is executed automatically when the system boots:

vi /etc/network/if-up.d/iptables


### Port Forwarding ###
iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 80 -j DNAT --to
iptables -A PREROUTING -t nat -p tcp -i eth0 --dport 25 -j DNAT --to

Now we have to make that script executable:

chmod 755 /etc/network/if-up.d/iptables

Whenever you need additional port forwarding rules, execute them on dom0's shell and then append them to /etc/network/if-up.d/iptables so that they are available even after a reboot.

Share this page:

8 Comment(s)

Add comment


From: harm at: 2006-10-20 12:17:22

Falko, although this is interesting to use with Sarge on relatively old hardware its useless on new hardware... eg. mainboards with Intel's ICH7 bridge will simply not function with Sarge's kernel (2.6.8) and your better of with Etch in that case. And Etc gets Xen with an easy apt-get :)

From: decep at: 2006-10-24 14:35:06

Compiling separate dom0 and domU kernels is considered to be the "old way" of doing things.  Ever since Xen 3 was released, a single kernel can be used for both dom0 and domU.

From: at: 2006-11-15 10:32:50

I just wanted to add a precision about the command :

mv /lib/tls /lib/tls.disabled 

Xen team advise users to disable TLS (Thread Local Storage) because of performance issues. It's not absolutly needed.

See the Xen team explanation.

From: at: 2006-12-09 05:45:45

If you're trying to compile Xen under a minimal Sarge net installation, 2 additional packages need to be installed prior to running "make world" : xlibs-dev libncurses5-dev Without these packages, the compile will fail near the end (very frustrating 30 minutes into the process). Adding build-essential to the apt-get install statement at the top of the page couldn't hurt either for completeness. Other than this, an excellent howto.

From: at: 2007-01-24 15:44:32

In my case it was mandatory that I install the build-essential package for "make world" to succeed. Thanks

 Additionally, I was getting kernel panics when the mem statement was present in the grub menu config. Removing it eliminated the kernel panic.

From: at: 2007-02-15 01:02:34

gcc-3.3 installed but did not leave a link to gcc. 

ln -s /usr/bin/gcc-3.3 /usr/bin/gcc

ln -s /usr/bin/gccbug-3.3 /usr/bin/gccbug

 Fixed this and I could start step 4.1.

From: at: 2006-11-15 14:22:18

/vserver/images/mail.img is not a block special device.

With this tutorial, the right message should be :

/vserver/images/vm_base.img is not a block special device.


From: at: 2007-05-06 16:13:39

During the make world command I had an issue not shure if it was due

to x86_64 or just the version of gcc I had.  I was getting errors like :


         LD      .tmp_vmlinux1
         init/built-in.o: In function `try_name':
         do_mounts.c:(.text+0x5d5): undefined reference to `__stack_chk_fail'
         init/built-in.o: In function `name_to_dev_t':


         initramfs.c:(.init.text+0x4001): undefined reference to   `__stack_chk_fail'

         arch/x86_64/kernel/built-in.o:(.text+0x3509): more undefined     references to  `__stack_chk_fail' follow

         make[1]: *** [.tmp_vmlinux1] Error 1

         make[1]: Leaving directory `/home/costin/linux-'

         make: *** [debian/stamp-build-kernel] Error 2


It took a while but when I used -fno-stack-protector  like:

All compiled like it was supposed to.  I am just now finishing my custom kernel to reboot to.