Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have my KVM guests on a standard br0 bridge setup:

auto br0
iface br0 inet static
   address 192.168.1.117
   netmask 255.255.255.0
   network 192.168.1.1
   broadcast 192.168.1.225
   gateway 192.168.1.1
   bridge_ports eth0
   bridge_stp off
   bridge_fd 0

auto eth1
iface eth1 inet static
address 10.0.0.117
netmask 255.255.255.0
gateway 10.0.0.1
broadcast 10.0.0.225

eth1 is reserved for other traffic but a guest could simply change it's ip to connect to it.

What I am trying to achieve is dropping all traffic towards the host / outside / other guest as soon as a guest attempts to change either it's ip address or mac address (in an attempt to join the other network / spoof another guest)

I tried many interfaces (eth0, br0, tap0, tap+) but I cannot seem to get my rule right:

iptables -A INPUT -m physdev --physdev-in tap+ --physdev-out tap+ -s 192.168.1.205 -m mac ! --mac-source 52:54:5a:8d:77:8e -j DROP

IP forwarding is enabled- there are no other rules in iptables. Am I missing something- or even should I consider try to achieve this another way?

share|improve this question
add comment

1 Answer

As far as I can see you just can't do some of the things you need to do with iptables. You need filtering at the bridge level. You should probably take a look at ebtables - it's like iptables for bridges.

Manual: http://ebtables.sourceforge.net/misc/ebtables-man.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.