Reputation
316
Top tag
Next privilege 500 Rep.
Access review queues
Badges
1 7 20
Impact
~61k people reached

  • 0 posts edited
  • 0 helpful flags
  • 48 votes cast
May
20
awarded  Notable Question
Mar
9
awarded  Notable Question
Mar
2
awarded  Popular Question
Nov
25
comment Configure IPTables on KVM host to block guest bridge traffic
Just to provide an update: physdev in iptables provides much of the functionality that I require, as you can examine the inbound and outbound to an interface on a bridge.
Nov
25
revised Configure IPTables on KVM host to block guest bridge traffic
added 222 characters in body
Nov
14
awarded  Popular Question
Oct
28
awarded  Notable Question
Jul
2
awarded  Curious
Jun
30
comment TigerVNC + SSH without a VNC Password?
Is this for the server or the VNC client?
Jun
26
awarded  Famous Question
May
12
awarded  Popular Question
Jul
18
awarded  Popular Question
Jul
9
awarded  Tumbleweed
May
17
awarded  Popular Question
Feb
26
awarded  Popular Question
Dec
25
accepted KVM is NOT seeing multiple bridges (only macvtap devices)
Dec
25
comment KVM is NOT seeing multiple bridges (only macvtap devices)
I'm still in the setup process, but I am going to go ahead and try basing the firewall restrictions on the MAC address of the VM guest NIC's. Thus, I'm marking this as the answer.
Dec
23
comment KVM is NOT seeing multiple bridges (only macvtap devices)
I'm going to try to implement this, and if it works, I will mark this as the answer.
Dec
22
comment KVM is NOT seeing multiple bridges (only macvtap devices)
Assuming I share the br0 interface, would I be able to achieve what I want to achieve by having iptables/ebtables filter based on the MAC assigned to the VM on the bridge?
Dec
22
comment KVM is NOT seeing multiple bridges (only macvtap devices)
The problem with relying on the vnet interfaces, is that they are not uniquely assigned to a VM. Namely, there is no guarantee that vnet0 will be assigned to say "vm1". Thus the tap interfaces allow be to be specific, and firewall rules can be applied to each specific VM. That is why I need to use tap devices. I need go be able to "jail" VMs in the event of a policy violation.