I have two physical hosts running Xen 3.2, sharing storage via iSCSI. On these two hosts are a number of domUs and I'd like to network them in multiple private networks so they can only contact other domUs on their private network.

My understanding of the xen documentation suggests it's possible to do this within one dom0 (ie create virtual networks between domUs), but I've found nothing explaining how this can be implemented across multiple dom0s on different hosts. The only thing that jumps to mind is manually creating iptable rules to route data to the other host, but this seems to lack elegance and could quickly grow cumbersome.

Any suggestions? All advice is much appreciated!