6:58 a.m.
All,
I'm trying to setup a network with some virtual machines, that can connect
to each other and to the internet, but neither to the host nor to other
VMs.
Is there any preconfigured network filter or best-practice for this setup?
Of course, I could setup iptables rules on the host, but I'd prefer
libvirt to handle them.
- Chris
8:33 a.m.
Hi there!
I would like to know the same! Currently I am using iptables to do it.
Thanks.
2017-06-05 8:58 GMT-03:00 Chris <chris2014(a)postbox.xyz>:
All,
I'm trying to setup a network with some virtual machines, that can connect
to each other and to the internet, but neither to the host nor to other
VMs.
Is there any preconfigured network filter or best-practice for this setup?
Of course, I could setup iptables rules on the host, but I'd prefer
libvirt to handle them.
- Chris
_______________________________________________
libvirt-users mailing list
libvirt-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users
9:07 a.m.
Hi Timo,
Could you please show me a rule example that you are using?
Thank you.
Thiago
2017-06-05 10:48 GMT-03:00 Timo Juhani Lindfors <timo.lindfors(a)iki.fi>:
Hi,
Thiago Oliveira <cpv.thiago(a)gmail.com> writes:
> I would like to know the same! Currently I am using iptables to do it.
I use ebtables.
-Timo
_______________________________________________
libvirt-users mailing list
libvirt-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users
9:33 a.m.
Thiago Oliveira <cpv.thiago(a)gmail.com> writes:
Could you please show me a rule example that you are using?
Here are some rules I'm using on a development VM. I think most of the
ideas come from the ebtables rules used by libvirt itself. These just
prevent IP spoofing. After this you can use IP addresses for access
control much better.
ebtables -t nat -A PREROUTING -i dev-home -j i-dev
ebtables -t nat -A POSTROUTING -o dev-home -j o-dev
ebtables -t nat -A i-dev -p IPv4 -j i-dev-ipv4
ebtables -t nat -A i-dev -p ARP -j i-dev-arp
ebtables -t nat -A i-dev -j DROP
ebtables -t nat -A o-dev -p IPv4 -j o-dev-ipv4
ebtables -t nat -A o-dev -p ARP -j o-dev-arp
ebtables -t nat -A o-dev -j DROP
ebtables -t nat -A i-dev-ipv4 -s ! [CENSORED] -j DROP
ebtables -t nat -A i-dev-ipv4 -p IPv4 --ip-src ! [CENSORED] -j DROP
ebtables -t nat -A i-dev-ipv4 -p IPv4 --ip-dst ! [CENSORED] -j DROP
ebtables -t nat -A o-dev-ipv4 -p IPv4 --ip-src ! [CENSORED] -j DROP
ebtables -t nat -A o-dev-ipv4 -j ACCEPT
ebtables -t nat -A i-dev-arp -s ! [CENSORED] -j DROP
ebtables -t nat -A i-dev-arp -p ARP --arp-mac-src ! [CENSORED] -j DROP
ebtables -t nat -A i-dev-arp -p ARP --arp-ip-src ! [CENSORED] -j DROP
ebtables -t nat -A i-dev-arp -p ARP --arp-op Request -j ACCEPT
ebtables -t nat -A i-dev-arp -p ARP --arp-op Reply -j ACCEPT
ebtables -t nat -A i-dev-arp -j DROP
ebtables -t nat -A o-dev-arp -p ARP --arp-op Reply --arp-mac-dst ! [CENSORED] -j DROP
ebtables -t nat -A o-dev-arp -p ARP --arp-ip-dst ! [CENSORED] -j DROP
ebtables -t nat -A o-dev-arp -p ARP --arp-op Request -j ACCEPT
ebtables -t nat -A o-dev-arp -p ARP --arp-op Reply -j ACCEPT
ebtables -t nat -A o-dev-arp -j DROP
-Timo
9:04 a.m.
On Mon, Jun 05, 2017 at 01:58:26PM +0200, Chris wrote:
All,
I'm trying to setup a network with some virtual machines, that can connect
to each other and to the internet, but neither to the host nor to other
VMs.
Is there any preconfigured network filter or best-practice for this setup?
Of course, I could setup iptables rules on the host, but I'd prefer
libvirt to handle them.
This can be done with the libvirt nwfilter APIs/commands, which will
automate the create/teardown of ebtables rules at vm start/stop. You
would have to ensure VMs get fixed IP addresses, and then define some
rules that block the VM subnet, except for whitelisted entries, as well
as blocking the host IP, but leaving other stuff open (to allow internet
access).
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
9:05 a.m.
Hi Chris,
for all kinds of network configuration together with
virtual machines anf libvirt/QEMU I use openvswitch.
libvirt together with openvswitch make it veryeasy to
handle.
Best regards
Holger
Am 05.06.2017 um 13:58 schrieb Chris:
All,
I'm trying to setup a network with some virtual machines, that can connect
to each other and to the internet, but neither to the host nor to other
VMs.
Is there any preconfigured network filter or best-practice for this setup?
Of course, I could setup iptables rules on the host, but I'd prefer
libvirt to handle them.
- Chris
_______________________________________________
libvirt-users mailing list
libvirt-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users
---
Diese E-Mail wurde von Avast Antivirus-Software auf Viren geprüft.
https://www.avast.com/antivirus
1:50 p.m.
Chris wrote:
I'm trying to setup a network with some virtual machines, that
can connect
to each other and to the internet, but neither to the host nor to other
VMs.
Thank you for your replies. Unfortunately, I didn't mention, that I'd like
to be able to test malicious software, so my network filtering shouldn't
depend on the guests' IP addresses. I think I have to setup a new virtual
"virus" interface and configure iptables on the host for this interface.
Is this possible?
- Chris
4:03 p.m.
On Tue, Jun 06, 2017 at 08:50:45PM +0200, Chris wrote:
Chris wrote:
> I'm trying to setup a network with some virtual machines, that can connect
> to each other and to the internet, but neither to the host nor to other
> VMs.
Thank you for your replies. Unfortunately, I didn't mention, that I'd like
to be able to test malicious software, so my network filtering shouldn't
depend on the guests' IP addresses. I think I have to setup a new virtual
"virus" interface and configure iptables on the host for this interface.
Is this possible?
You can use the network filters to setup antispoofing protection for both
IP addresses and MAC addresses. In fact this is what the "clean-traffic"
example filter libvirt provides will do for you.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
9:37 p.m.
Daniel,
Are you talking about XML? If yes, could please show us an example?
Thank you.
Thiago
2017-06-06 18:03 GMT-03:00 Daniel P. Berrange <berrange(a)redhat.com>:
On Tue, Jun 06, 2017 at 08:50:45PM +0200, Chris wrote:
> Chris wrote:
> > I'm trying to setup a network with some virtual machines, that can
connect
> > to each other and to the internet, but neither to the host nor to other
> > VMs.
>
> Thank you for your replies. Unfortunately, I didn't mention, that I'd
like
> to be able to test malicious software, so my network filtering shouldn't
> depend on the guests' IP addresses. I think I have to setup a new virtual
> "virus" interface and configure iptables on the host for this interface.
> Is this possible?
You can use the network filters to setup antispoofing protection for both
IP addresses and MAC addresses. In fact this is what the "clean-traffic"
example filter libvirt provides will do for you.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/
dberrange :|
|: https://libvirt.org -o-
https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/
dberrange :|
_______________________________________________
libvirt-users mailing list
libvirt-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-users
3:25 a.m.
On Tue, Jun 06, 2017 at 11:37:27PM -0300, Thiago Oliveira wrote:
Daniel,
Are you talking about XML? If yes, could please show us an example?
<domain>
...
<devices>
....
<interface type='bridge'>
<mac address='00:16:3e:5d:c7:9e'/>
<filterref filter='clean-traffic'/>
</interface>
....
</devices>
...
</domain>
There is quite alot more info here:
http://libvirt.org/formatnwfilter.html
http://libvirt.org/firewall.html
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
1:32 p.m.
Hi Daniel,
I added the option <filterref filter='clean-traffic'/> and my VM stop to
ping the gateway and the others VM's in the same host.
I would like to prevent that VM's in differents subnets can ping or spoof
others VM's. Each subnet is related with a customer and I would like to
separete the traffic like VLAN does.
Is this possible with some options in xml ?
Thank you very much.
Thiago
2017-06-07 5:25 GMT-03:00 Daniel P. Berrange <berrange(a)redhat.com>:
On Tue, Jun 06, 2017 at 11:37:27PM -0300, Thiago Oliveira wrote:
> Daniel,
>
> Are you talking about XML? If yes, could please show us an example?
<domain>
...
<devices>
....
<interface type='bridge'>
<mac address='00:16:3e:5d:c7:9e'/>
<filterref filter='clean-traffic'/>
</interface>
....
</devices>
...
</domain>
There is quite alot more info here:
http://libvirt.org/formatnwfilter.html
http://libvirt.org/firewall.html
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/
dberrange :|
|: https://libvirt.org -o-
https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/
dberrange :|
2:18 p.m.
Daniel P. Berrange wrote:
<filterref filter='clean-traffic'/>
There is quite alot more info here:
http://libvirt.org/formatnwfilter.html
http://libvirt.org/firewall.html
Ok, clean-traffic! Good idea. I'll try this.
- Chris
2725
days inactive
2727
days old
12 comments
5 participants
participants (5)
-
Chris -
Daniel P. Berrange -
Holger Schranz -
Thiago Oliveira -
Timo Juhani Lindfors