Xen: how to limit IPs for VMs

Question

How can i limit Xen VMs so that they only work with some specified IPs?

Eg.: vm01 should have IP 192.168.0.2. If it tries to change to another IP, it will simply not work and vm will lose connectivity.

Something like it's done on EC2, they surely limit so you can only assign your own ips.

Thanks.

Answer 1

It depends on how you are managing your VMs.

However, you can configure the firewall on the VM host to do this. You can set up rules that work only with the specific MAC address of the virtual ethernet card. The virtual ethernets are typically bridged onto a host.

You can also use a different IP/subnet combination for each individual IP and then perform the necessary routing on the host firewall as well.

You can even employ some VLAN tagging if your equipment supports it to logically isolate the different machines onto different networks.

Essentially, it's all networking.

Answer 2

The simplest solution would be to set up according iptables-rules in the Dom0 for the VIFs of that DomU (rather than using the MAC-address).

These rules should allow all incoming traffic, all outgoing multicast/broadcast but only unicast for the IP the VM is supposed to have.