I have a "development" KVM server here at the office, setup in a bridged networking setup with a few KVM guests running on it. For each KVM guest a virtual interface is created on the node with the name
kvm126.0 when the guest boots.
Yesterday I was playing around and wanted to see how I could nullroute a KVM guest in case I needed to.
So I tried
route add ip_address reject which had no effect, as no effect had
route add ip_address gw 127.0.0.1 lo or
ip route add blackhole ip_address/32.
Since it's a bridged network setup, I get why the above didn't work.
Next try was with iptables; I tried
iptables -A INPUT -s ip_address -j DROP iptables -A FORWARD -s ip_address -j DROP
which did the trick, I couldn't ping the KVM guest anymore.
Now the thing is that if I were a malicious user, I would start trying other neighboring IPs until I find one that doesn't conflict with another guest and statically assign it to my VPS.
So what I would like to know is, if there's a way to block traffic from this guest's particular interface, no matter what IP he has managed to configure his guest machine with.