3

I have a "development" KVM server here at the office, setup in a bridged networking setup with a few KVM guests running on it. For each KVM guest a virtual interface is created on the node with the name kvm[id].0 e.g. kvm126.0 when the guest boots. Yesterday I was playing around and wanted to see how I could nullroute a KVM guest in case I needed to.

So I tried route add ip_address reject which had no effect, as no effect had route add ip_address gw 127.0.0.1 lo or ip route add blackhole ip_address/32. Since it's a bridged network setup, I get why the above didn't work.

Next try was with iptables; I tried

iptables -A INPUT -s ip_address -j DROP
iptables -A FORWARD -s ip_address -j DROP

which did the trick, I couldn't ping the KVM guest anymore.

Now the thing is that if I were a malicious user, I would start trying other neighboring IPs until I find one that doesn't conflict with another guest and statically assign it to my VPS.

So what I would like to know is, if there's a way to block traffic from this guest's particular interface, no matter what IP he has managed to configure his guest machine with.

Improve this question

1 Answer 1

Reset to default
2

You could connect to the monitor and shut down the link:

(qemu) set_link tap.0 down

The command info network will list the network interfaces.

Note that you must detach the monitor with Ctrl+C. Using q or quit wourld terminate the VM.

Improve this answer
1
  • 1
    I'm using virsh instead of qemu, but your answer led me to a command line list, where I found the virsh detach-interface command, that does exactly what I need :) So, thanks!
    – George Tasioulis
    Oct 13, 2012 at 23:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .