I've got a KVM server inside a local network (192.168.10.0/24). This server has three interfaces, which are all publicly bridged [1]. Atm I'm only using two of the three interfaces, so the virtual machines are divided into two groups (one using bridge0, the other one using bridge1).
Is it possible to setup a firewall (iptables) on the host, to disallow internet access for the group using bridge1? Or do I need a different setup (routing through the host)?
[1] http://www.linux-kvm.org/page/Networking#public_bridge
I tried the following (but doesn't seem to work):
- allow everything over local loopback
- allow everything over bridge0
- allow only local network traffic over bridge1
- deny everything else
The corresponding iptables -S
output:
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -i bridge0 -m state --state NEW -j ACCEPT
-A INPUT -s 192.168.10.0/24 -d 192.168.10.0/24 -i bridge1 -m state --state NEW -j ACCEPT
-A INPUT -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i bridge0 -m state --state NEW -j ACCEPT
-A FORWARD -o bridge0 -m state --state NEW -j ACCEPT
-A FORWARD -s 192.168.10.0/24 -d 192.168.10.0/24 -i bridge1 -m state --state NEW -j ACCEPT
-A FORWARD -s 192.168.10.0/24 -d 192.168.10.0/24 -o bridge1 -m state --state NEW -j ACCEPT
-A FORWARD -j DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -m state --state NEW -j ACCEPT
-A OUTPUT -o bridge0 -m state --state NEW -j ACCEPT
-A OUTPUT -s 192.168.10.0/24 -d 192.168.10.0/24 -o bridge1 -m state --state NEW -j ACCEPT
-A OUTPUT -j DROP