Re: [libvirt] Fwd: libvirtd and listen_addr
On 07/01/2011, at 4:39 AM, Daniel Huhardeaux wrote:
Le 06/01/2011 18:16, Justin Clift a écrit :
[...]
> Hmmm, in your libvirtd.conf file, what does the line say where you have
"listen_addr"?
>
> I'm thinking it should be something like:
>
> listen_addr = "0.0.0.0"
>
> Which I *think* tells it to bind to everything it can.
>
> ?
Yes but that's not what I want. Let's say we have 3 servers each of them with VMs
and all connected through OpenVPN
server 1: VMs Net 10.0.1.1 (IP of server virbr0) VMs from .1.11 to ...
server 2: VMs Net 10.0.2.1 (IP of server virbr0) VMs from .2.11 to ...
server 3: VMs Net 10.0.3.1 (IP of server virbr0) VMs from .3.11 to ...
Having OpenVPN running, each VM -or other host running OpenVPN- can reach each other. So
what I want, for security reason, is that listen_addr of each server is *only*
10.0.[1|2|3].1 which is transparent and independant of other network settings (public
addresses, localnet, other VPN, ...).
Hope I clarify my needs :-)
Heh, yeah. I think Daniel Berrange's approach of using firewall rules to control the
access is probably the most rugged...
My only other thought, and probably pretty fragile unless you put good scripting around
it, is to still do the restarting thing, but change the listen_addr entry before the
restart.
Though, I think it'll be an interesting (bad) situation if you want to change or
restart one of the virtual networks when libvirtd is attached to it. Can see problems
with that. ;)