Hetzner is a hosting company in Germany where you can rent dedicated root servers per month. Using their KVM-over-IP setup, it is possible to install operating systems that are not available by default, such as XenServer by Citrix. With the machine, you get four public IP addresses. One of these addresses is given to you when the machine is assigned to you, the other three are assigned to you on request.

There is a problem with the public IP addresses Hetzner gives you. Within the Hetzner network, there is a hard connection between the MAC address of your machine and the IP addresses you have been given. This is a problem for virtual machines that are bridged onto the network by the host machine. These virtual machines have their own MAC address and the Hetzner network will drop packets from these unknown MAC addresses.

There is a solution to this problem: have the host machine route IP packets from the virtual machines to the network and vice versa. We will use the following addresses in the example below:

IP addresses 188.40.109.204 (host), 188.40.109.250 (VM)
Netmask 255.255.255.192
Gateway 188.40.109.193 (host)
DNS 213.133.100.100

We start with the configuration of the host machine (running XenServer). The first file is the configuration file of eth0: /etc/sysconfig/network-scripts/ifcfg-eth0

XEMANAGED=yes
DEVICE=eth0
ONBOOT=no
TYPE=Ethernet
HWADDR=40:61:86:be:ce:88 (replace with MAC address of host)
BRIDGE=xenbr0

Notice that this file does not contain any IP configuration. The second file is the configuration file of xenbr0: /etc/sysconfig/network-scripts/ifcfg-xenbr0

XEMANAGED=yes
DEVICE=xenbr0
ONBOOT=no
TYPE=Bridge
DELAY=0
STP=off
PIFDEV=eth0
BOOTPROTO=none
IPADDR=188.40.109.204 (replace with IP address of host)
NETMASK=255.255.255.192
GATEWAY=188.40.109.193 (replace with gateway of host)
DNS1=213.133.100.100
DNS2=213.133.99.99
DNS3=213.133.98.98

Now we need to enable IP forwarding on the host machine. We start with the sysctl configuration file: /etc/sysctl.conf

net.ipv4.ip_forward=1
net.ipv4.conf.all.send_redirects=0
net.ipv4.conf.default.send_redirects=0
net.ipv4.conf.lo.send_redirects=0
net.ipv4.conf.xenbr0.send_redirects=0

The first line tells the machine to perform IP forwarding. The four lines after that tell the machine to disable sending ICMP redirects. The last file we need to edit is the firewall configuration file: /etc/sysconfig/iptables. Add this text below the line -A RH-Firewall-1-INPUT -i lo -j ACCEPT:

-A RH-Firewall-1-INPUT -i xenbr0 -o xenbr0 -j ACCEPT

Now reboot the machine and continue with the IP configuration of the virtual machine running on XenServer. There is only one file we need to edit here, which is the configuration file of eth0: /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0
BOOTPROTO=none
ONBOOT=yes
HWADDR=8e:35:1e:3b:12:aa (replace with MAC address of VM)
IPADDR=188.40.109.250 (replace with IP address of VM)
NETMASK=255.255.255.192
GATEWAY=188.40.109.204 (replace with IP address of host)

The gateway in this configuration is crucial: it needs to be the IP address of the host itself, not the gateway of the host.

Using XenServer in a routed IP network
Tagged on:

16 thoughts on “Using XenServer in a routed IP network

  • 2010-06-22 at 17:27
    Permalink

    thank you for this tutorial, but what do you do if there are several VMs (and several IP addresses)

    Reply
    • 2010-06-22 at 20:27
      Permalink

      The main part of the tutorial stays the same. Just repeat the bottom part where we configure the VM, using a different IP address for each VM.

      Reply
  • 2010-06-22 at 22:15
    Permalink

    Thank you, Jan for quick reply. I tried so, but when I started dummy interface I got this:

    ifup xenbr0:1
    Device xenbr0:1 has different MAC address than expected, ignoring.

    maybe it’s expecting mac from eth0 .. and still no ping to vm

    Reply
  • 2010-06-23 at 00:12
    Permalink

    sorry, ping is ok, but vm is throwing error about ip conflict
    vm network configuration is the same as xenbr1:0

    Reply
  • 2010-06-24 at 21:21
    Permalink

    what if vm and host ip are in different subnets ?

    Reply
    • 2010-06-27 at 08:17
      Permalink

      I haven’t tested it yet, but it probably means that you need to assign the host one of the IP addresses in the extra subnet and then use that IP address as the gateway for the VM.

      Reply
  • 2010-09-24 at 01:32
    Permalink

    I would also like to add another network (192.168.x.x). No problem to install it on the VMs, but how do I configure the Host so I get internet access from a VM using such a private IP only?

    Reply
  • Pingback:Hetzner EQ root server & XenServer 5.6: Howto use additional IP subnets | blog.janjonas.net

  • 2011-08-20 at 17:37
    Permalink

    Thank you very much! It solved my problem!

    Reply
  • 2012-02-04 at 14:27
    Permalink

    This has been a very helpful guide for 5.6!! Thanks a lot! -But things has changed for 6.0 Is there any chance some knows how to tackle that one..?

    Reply
  • 2012-02-10 at 12:22
    Permalink

    Me myself and I, We fixed it!

    Here is a very simplified version, tested and working on xenserver 6! Should also be fine for earlier versions.

    In xenserver, edit this file:
    /etc/sysctl.conf
    Change:
    net.ipv4.ip_forward = 0
    To:
    net.ipv4.ip_forward = 1
    Add (below the line you just changed):
    # Prevent redirects to make system more secure
    net.ipv4.conf.default.send_redirects = 0
    net.ipv4.conf.lo.send_redirects = 0
    net.ipv4.conf.xenbr0.send_redirects = 0

    Safe the file and exit the file editor.
    Reboot, or use this command:
    sysctl -p

    Make exception to firewall with this command:
    system-config-securitylevel-tui
    Go to Customize, and select xenbr0 as Trusted Device, OK, and OK again.
    Reboot, or restart the firewall, with this command:
    service iptables restart

    Now you can configure your VMs with gateway = IP of host (xenserver).
    Thats it honey!

    If anyone knows how to make this more secure, regarding the firewall by only allowing IPs from specific VMs. Please shout out (:

    Reply
    • 2012-03-05 at 11:53
      Permalink

      Hello,

      What about if I want to give some VMs private ip what should I do?

      Thanks

      Reply
  • 2012-02-23 at 06:59
    Permalink

    I have noticed that in XenServer v6 any changes made to ifcfg-xenbr0 are gone back to default on reboot or when I restart the network. Following lines are missing:

    TYPE=Bridge
    DELAY=0
    STP=off
    PIFDEV=eth0

    Reply
  • 2012-05-10 at 12:37
    Permalink

    Thanks jansipke,

    Good information.

    Really helpful.

    Reply
  • 2015-03-30 at 18:45
    Permalink

    Nice Article,
    but in my xen server 6.5 installation I can’t find any file name ifcfg-eth0

    I have created the xenbr0:1 and enabled the forwarding.

    I run the endian firewal as router that own the second ip available in the same subnet of the management newtwork and give dhcp to a private network with other vps but the endian and the virtual machines can’t reach the connection..

    I’m not understanding where i’m wrong…! help!

    Reply
  • Pingback:Installing XenServer and Virtual Hosts in a Routed Network | synyx - Blog

Leave a Reply

Your email address will not be published. Required fields are marked *