Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have the following setup:

  1. Hyper-V host with 2 network cards (Windows 2012 core)
  2. One network card is for management only, with private IP address accessible locally. Called "Management".
  3. The other is configured with "Allow management operating system to share this network adapter" not checked. Called "Public".
  4. All virtual machines that I am creating have only one network card in the Public network.

Provisioning of VMs and limitations:

  1. Virtual machines are provisioned from syspreped images.
  2. Unattend.xml contains everything I need and that is: network configuration, expanding the root partition, password, enabling remote desktop and so on.
  3. After a VM is powered on it will be managed by some one else. Meaning that I will not have access to that VM.

No my question is: The one administrating the VMs can configure any IP address inside the guest. Is there a way to bind a specific IP address to a VM? Filtering on the host maybe?

For instance in linux with bridges this can be done with:

ebtables -A FORWARD -i ${DEVICE} -s ! ${MACADDR} -j DROP
ebtables -A FORWARD -s ${MACADDR} -p IPv4 --ip-src ! ${IPADDR} -j DROP

On Hyper-V I found: http://msdn.microsoft.com/en-us/library/windows/hardware/hh598161(v=vs.85).aspx But I can't figure it out, how it works and if it can be used for what I need.

share|improve this question

1 Answer 1

up vote 5 down vote accepted

Ok, I figured it out:

Add-VMNetworkAdapterAcl  -VMName $vmName -LocalIPAddress $vmIP -Direction Both -Action Allow
Add-VMNetworkAdapterAcl  -VMName $vmName -LocalIPAddress Any -Direction Both -Action Deny

This will limit a VM guest to use only a specific IP address. If he changes the IP, he will not be able to reach the internet or any other local IP address on other guest VMs on that specific hyper-v node.

And here is the documentation: http://technet.microsoft.com/en-us/library/jj679878.aspx#bkmk_portacls

share|improve this answer
    
Wow. I didn't know you could do that. –  Ryan Ries Jun 2 '13 at 14:22
    
+1 for that. SERIOUSLY nice in a hosting envionronment and I think not many people know that ;) I did not. –  TomTom Jun 2 '13 at 15:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.