This system (Dom0) has multiple interfaces:
br0: internal - subnet1 (private IP connects to DomU's)
- subnet2 (private IP)
- subnet3 (public IP)
FW_MASQ_NETS= private IP subnets
FW_TRUSTED_NETS= all MY subnets
FW_FORWARD= configured appropriately including subnet2 <--> subnet3
Networking was working pretty much as expected except there was no
communication between subnet2 and subnet3. I assumed this was because
they are on the same interface and routing is -between- interfaces.
> ## Type: string
> ## Default:
> # 33.)
> # Bridge interfaces without IP address
> # Traffic on bridge interfaces like the one used by xen appears to
> # enter and leave on the same interface. Add such interfaces here in
> # order to install special permitting rules for them.
> # Format: list of interface names separated by space
> # Note: this option is deprecated, use FW_FORWARD_ALLOW_BRIDGING
> # Example:
> # FW_FORWARD_ALWAYS_INOUT_DEV="xenbr0"
Since FW_FORWARD_ALLOW_BRIDGING was already set to "yes", I resolved
this routing issue by setting FW_FORWARD_ALWAYS_INOUT_DEV="eth3". But
eth3 is not really a bridge and this option is depreciated. Is there
another way to make this work, other than by assigning each subnet to
its own interface, or is this configured correctly?