291 reputation
1519
bio website slashsarc.com
location United States
age 27
visits member for 4 years, 8 months
seen Nov 25 at 23:47

I love technology, and finding ways to help others utilize technology to it's fullest potential!


Nov
25
comment Configure IPTables on KVM host to block guest bridge traffic
Just to provide an update: physdev in iptables provides much of the functionality that I require, as you can examine the inbound and outbound to an interface on a bridge.
Nov
25
revised Configure IPTables on KVM host to block guest bridge traffic
added 222 characters in body
Nov
14
awarded  Popular Question
Oct
28
awarded  Notable Question
Jul
2
awarded  Curious
Jun
30
comment TigerVNC + SSH without a VNC Password?
Is this for the server or the VNC client?
Jun
26
awarded  Famous Question
May
12
awarded  Popular Question
Jul
18
awarded  Popular Question
Jul
9
awarded  Tumbleweed
May
17
awarded  Popular Question
Feb
26
awarded  Popular Question
Dec
25
accepted KVM is NOT seeing multiple bridges (only macvtap devices)
Dec
25
comment KVM is NOT seeing multiple bridges (only macvtap devices)
I'm still in the setup process, but I am going to go ahead and try basing the firewall restrictions on the MAC address of the VM guest NIC's. Thus, I'm marking this as the answer.
Dec
23
comment KVM is NOT seeing multiple bridges (only macvtap devices)
I'm going to try to implement this, and if it works, I will mark this as the answer.
Dec
22
comment KVM is NOT seeing multiple bridges (only macvtap devices)
Assuming I share the br0 interface, would I be able to achieve what I want to achieve by having iptables/ebtables filter based on the MAC assigned to the VM on the bridge?
Dec
22
comment KVM is NOT seeing multiple bridges (only macvtap devices)
The problem with relying on the vnet interfaces, is that they are not uniquely assigned to a VM. Namely, there is no guarantee that vnet0 will be assigned to say "vm1". Thus the tap interfaces allow be to be specific, and firewall rules can be applied to each specific VM. That is why I need to use tap devices. I need go be able to "jail" VMs in the event of a policy violation.
Dec
22
revised KVM is NOT seeing multiple bridges (only macvtap devices)
Added output from the `brctl show` command.
Dec
22
comment KVM is NOT seeing multiple bridges (only macvtap devices)
The purpose is to have each interface unique so that ebtables and iptables can perform on-the-fly firewall restrictions to each VM. Thus, I need a way to have each VM specified to a unique bridged interface. That is why I am using the tap interfaces.
Dec
22
revised KVM is NOT seeing multiple bridges (only macvtap devices)
added 123 characters in body