Nested bridging: Can reach hosting VM, but not Domain-0 nor upstream network (solved)

Question

The setup of my box is as follows:

I'm using Xen on bare metal, with Domain-0 (Debian Bullseye) serving as X terminal. Here I have created a bunch of VMs (including the one that is connecting to the X terminal in Domain-0) that are connected to a bridge. Any traffic bound for the upstream network is routed to the interface connected to the upstream router (i. e. it's not a port of said bridge).

Now, in the VM that I'm working in (Debian Bullseye), I am attempting to set up nested virtualization with KVM (VM is Debian Bullseye) for testing purposes (VMX passthrough is enabled for this VM) and have set up another bridge in this "master" VM and attached its outbound interface to it. The nested VM that I have created has its back-end interface tied to this "inner" bridge as well.

Now, when I'm attempting to reach a network from the nested VM, I can reach the VM hosting the nested VM without problems, however, when I attempt to ping Domain-0 or any host on the Internet, that is filtered. Also, I can normally reach both Domain-0 and the Internet from said "master" VM, which in turn tells me that the bridge in Domain-0 is filtering all traffic from the nested VM.

Is there a way to configure the bridge residing in Domain-0 so that it lets the traffic from the nested VM pass? I don't intend to use routing within the "master" VM (although that would solve the problem for sure, that's not my intent).

This question has unfortunately turned out to be inconclusive as its author is attempting to tackle the problem from within the "master" VM whereas I'm attempting to solve it from the outside, that is, within Domain-0.

Answer 1

Further investigation revealed that this problem has been a firewall issue. By placing logging rules into ebtables's PREROUTING chain in Domain-0 as well as in the PREROUTING and POSTROUTING chains in the DomU hosting the nested VM, I noticed that Domain-0 wasn't receiving any packets at all, and checking in the hosting DomU revealed that ICMP packets were arriving on the back-end interface created by the nested VM, but they haven't been forwarded to the outbound PV front-end interface.

By adding iptables rules that exempt bridged traffic from being processed (a simple iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT in the hosting DomU did the trick here) I was finally able to reach upstream servers (Domain-0, other DomUs running under Xen, and last but not least machines on the 'Net).

Prior to that I had already reenabled STP on all bridges in Domain-0 and the bridge in the hosting DomU and also set several parameters related to that to reasonable values.