{"id":375,"date":"2007-10-18T20:38:58","date_gmt":"2007-10-18T19:38:58","guid":{"rendered":"http:\/\/wp.devco.net\/?p=375"},"modified":"2009-10-09T17:42:20","modified_gmt":"2009-10-09T16:42:20","slug":"xen_bridging_and_hetzner","status":"publish","type":"post","link":"https:\/\/www.devco.net\/archives\/2007\/10\/18\/xen_bridging_and_hetzner.php","title":{"rendered":"XEN, Bridging and Hetzner"},"content":{"rendered":"<p>I&#8217;ve a machine at <a href=\"http:\/\/www.hetzner.de\/\">Hetzner DE<\/a> and have been pretty happy with it and their service in general.  I used to run <a href=\"http:\/\/www.vmware.com\/server\/\">VMWare Server<\/a> on it for virtualisation but have become a bit annoyed at the totally unfixable clock problems that seems to be the norm with VMWare guests.<br \/>\nFirst the good news.  I decided to give <a href=\"http:\/\/xen.xensource.com\/\">XEN<\/a> a try on it, same setup same spec virtual machine on the host doing the same workload as before, below a CPU usage graph before and after, enough said.<br \/>\n<center><img decoding=\"async\" src=\"http:\/\/www.devco.net\/images\/vmware-xen-cpu.png\"><\/center><br \/>\nI know it&#8217;s not the same technology etc, but XEN VMs will do what I need now so it seems a good option for me.<br \/>\nNow for the bad, I had a few problems:<\/p>\n<ul>\n<li>Hetzner uses a DHCP\/TFTP rescue system that is very useful, if I make a mistake in a network config for example I can sort it out via this.  XEN by default works in a bridged mode that will change the MAC address for your eth0 to FE:FF:FF:FF:FF:FF.  The problem is that Hetzner uses Realtek NICs which as most people know are uber crap.  When the machine gets a normal alt-ctrl-del or other reboot other than a power cycle the NIC does not reset to the original MAC.  So if I get a crash I wont ever get to the rescue system.   This cost me 119 Euro this weekend in support fees.<\/li>\n<li>In the past I had a few crashes on this machine, adding <i>acpi=force irqpoll noapic<\/i> to the kernel command line solved it, however the XEN kernel won&#8217;t poll my drives properly without removing the <i>noapic<\/i> bit, so I hope my machine doesn&#8217;t become unstable all of a sudden.<\/li>\n<\/ul>\n<p>I am using <a href=\"http:\/\/www.centos.org\/\">CentOS 5.0<\/a> on this machine that came with XEN out of the box so installation was dead easy, creating new VM&#8217;s are easy etc and very importantly I can manage the VM&#8217;s all through text consoles which was a pain for me under VMWare as I don&#8217;t use Windows or Linux, getting console access was tough.<br \/>\nSo about the MAC address, this turned out incredibly easy to fix by turning the machine into a routed network setup instead of a bridge, so previously the network was bridging eth0 with the vif&#8217;s from the virtual machines onto the wire, this required the MAC address of eth0 to change.  Moving to a routed setup required the following changes:<br \/>\n<b>\/etc\/sysctl.conf<\/b>:<\/p>\n<blockquote><p>\nnet.ipv4.ip_forward = 1<br \/>\nnet.ipv4.conf.all.proxy_arp = 1\n<\/p><\/blockquote>\n<p>This basically enables routing and sets up proxy arp across all interfaces, this is to work with Hetzner&#8217;s routing where they don&#8217;t actually add a route to my subnet over my eth0 but over to the switch is connected too.  Proxy ARP sorts this out.<br \/>\n<b>\/etc\/xen\/xend-config.sxp<\/b>:<\/p>\n<blockquote><p>\n#(network-script network-bridge)<br \/>\n#(vif-script vif-bridge)<br \/>\n(vif-script     vif-route)<br \/>\n(network-script network-route)\n<\/p><\/blockquote>\n<p>This points XEN to its provided route scripts rather than the bridge ones.<br \/>\nReboot virtual machines and thats that.  Machine is perfectly happy, routing traffic and MAC address is correct.<br \/>\nBonus is now all traffic gets routed through my Dom0 and I can now do all the firewalling there outside of my DomU&#8217;s which enhances security as it is essentially a border firewall.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I&#8217;ve a machine at Hetzner DE and have been pretty happy with it and their service in general. I used to run VMWare Server on it for virtualisation but have become a bit annoyed at the totally unfixable clock problems that seems to be the norm with VMWare guests. First the good news. I decided [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","footnotes":""},"categories":[6],"tags":[48],"_links":{"self":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts\/375"}],"collection":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/comments?post=375"}],"version-history":[{"count":1,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts\/375\/revisions"}],"predecessor-version":[{"id":962,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/posts\/375\/revisions\/962"}],"wp:attachment":[{"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/media?parent=375"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/categories?post=375"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devco.net\/wp-json\/wp\/v2\/tags?post=375"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}