0

I have a Linux server that is running the KVM hypervisor. I have multiple bridges on this server (that are on different VLANS).

Is there an "easy" way to make sure that bridge hoping (i.e. routing between bridges) isn't allowed, however still allowing bridging within a bridge?

I know I can solve this by simply not assigning any IPs to the bridges, or any interfaces on the Linux box, but I'd rather also have a fail-safe to make sure this isn't allowed. Some iptables rule perhaps to keep traffic within a bridge?

Thanks

4
  • 1
    Don't set up any routes? Oct 22, 2014 at 21:03
  • Yes, that would work, however it's not really a foolproof safeguard though, as routes can be added/removed accidentally by simply adding an IP to an interface. I'm looking for a sweeping iptables rule that would stop bridge-hopping.
    – Jonny
    Oct 22, 2014 at 21:59
  • 2
    That's not foolproof either, since somebody can just accidentally turn off the firewall. Oct 22, 2014 at 23:24
  • Maybe use ebtables?
    – hookenz
    Oct 22, 2014 at 23:35

2 Answers 2

0

I don't believe IPTables will help much here as it is meant to manipulate layer 3 traffic.

By using a bridge, you create a layer 2 broadcast domain that is shared by all VLANs on the parent interface(s) of the bridge.

Open vSwitch can be configured to isolate VLANs. Keep in mind that if you need your KVM guests to have 1518 byte ethernet frames, you will need a network card for the KVM host that can handle ethernet frame sizes larger than 1522 bytes to allow for a VLAN tag.

Note: the layers I refer to above are the layers of the OSI model.

0

Per https://vincent.bernat.im/en/blog/2017-linux-bridge-isolation

Since linux 3.9 you can turn on vlan filtering on the bridge. This is a quick and easy way to avoid the traffic to enter IP routing and bridge hopping.

# echo 1 > /sys/class/net/br0/bridge/vlan_filtering
# bridge vlan del dev br0 vid 1 self

The article lists a few other options, which are using tc filters, ebtables, namespaces, or implementing protocol filters for each separate protocol type (typically ARP, IP, IPv6).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .