Blocking VM's network temorarily from host machine in KVM

Question

I am trying to perform few changes to a running VM's MAC address and obtain new IP address. Currently the VMs are connected to the outside network through the host's bridge interface. I would like to temporarily (10-20 seconds) block the VM's network connection from the host machine except for the packets relating to dhcp.

Is it possible?

Answer 1

Sure, you can either disconnect the VM from the host network, or just apply relevant iptables or ebtables rules to block packets from going anywhere.

Without more details of how your network is setup, it's impossible to give you more detailed commands, but they're all basic administrative tasks.

Answer 2

If you are using bridged networking for the VM, simply remove the VM's interface from the bridge adapter, perform the changes, then add it back. If the host is linux os, you need the bridge-utils package installed (probably it is already). Run this:

brctl show

to see what bridge devices are up and running, identify your bridge name and your VM network adapter, then remove it from bridge:

brctl delif brdev0 vmdev0 

Do what you need to do on the VM and when you're done, add it back to the bridge:

brctl addif brdev0 vmdev0

PS: the above commands should be ran as root.

Answer 3

I assume your point is to find a way to apply filters per a specific VM instance from the host side? Applying the filters to the host's outgoing interface is not different from any normal iptables setup, but then the VM's will be able to communicate between each other unfiltered.

Have you tried applying normal iptables and ebtables rules to the corresponding vnetNNN interfaces in the host? I have not tried it myself but I think there is a good chance that it would work.

If you are using libvirt to manage your QEMU/KVM instances, you can do virsh dumpxml VMNAME and look for a line such as <target dev='vnet0'/> to see the relevant vnet interface.