Re: [libvirt] Fwd: libvirtd and listen_addr

On 07/01/2011, at 4:39 AM, Daniel Huhardeaux wrote: > Le 06/01/2011 18:16, Justin Clift a écrit : > > [...] > >> Hmmm, in your libvirtd.conf file, what does the line say where you have "listen_addr"? >> >> I'm thinking it should be something like: >> >> listen_addr = "0.0.0.0" >> >> Which I *think* tells it to bind to everything it can. >> >> ? > > Yes but that's not what I want. Let's say we have 3 servers each of them with VMs and all connected through OpenVPN > > server 1: VMs Net 10.0.1.1 (IP of server virbr0) VMs from .1.11 to ... > server 2: VMs Net 10.0.2.1 (IP of server virbr0) VMs from .2.11 to ... > server 3: VMs Net 10.0.3.1 (IP of server virbr0) VMs from .3.11 to ... > > Having OpenVPN running, each VM -or other host running OpenVPN- can reach each other. So what I want, for security reason, is that listen_addr of each server is *only* 10.0.[1|2|3].1 which is transparent and independant of other network settings (public addresses, localnet, other VPN, ...). > > Hope I clarify my needs :-) Heh, yeah. I think Daniel Berrange's approach of using firewall rules to control the access is probably the most rugged...