Just had to spend half a night to make move a XenServer lab behind a firewall
Now, the servers are behind a NAT firewall, but my ISO repositories and the test NFS SR are not.
The two steps to get a solution were:
- enable insecure mounting of the shares, because the NATting scrambles the ports
- use TCP instead of UDP for the mount
The right hints came from this mailing list thread:
So what I did was patch the NFS storage manager on both nodes.
In this thread: Kelvin Vanderlip and someone at Softlayer, the internet is rather small at times.
The nicest thing: 100MB/s read throughput… I’m more than surprised!
This traffic comes into the Debian PV domU on XenServer via XenServers’ OpenVswitch. The XenServers are, like the pfSense only VMs running on ESXi. So next, the pfSense firewall, doing NAT, two of the VMWare vSwitches, 3 real gigabit switches and again OpenVswitch till it finally hits the File server.
Except for the ISO repository which comes re-exported from a LizardFS share.