xen-users

[Top] [All Lists]

Re: [Xen-users] ip source access policy per domU

from [James Oakley]

[Permanent Link][Original]

To:	xen-users@xxxxxxxxxxxxxxxxxxx
Subject:	Re: [Xen-users] ip source access policy per domU
From:	James Oakley <joakley@xxxxxxxxxxxxxxx>
Date:	Tue, 3 Oct 2006 16:55:59 -0300
Delivery-date:	Tue, 03 Oct 2006 15:35:43 -0700
Envelope-to:	www-data@xxxxxxxxxxxxxxxxxx
In-reply-to:	<2E89B96B-9E41-4CD3-884B-7E69090DC6C3@xxxxxxxxxxxxxxxxxx>
List-help:	<mailto:xen-users-request@lists.xensource.com?subject=help>
List-id:	Xen user discussion <xen-users.lists.xensource.com>
List-post:	<mailto:xen-users@lists.xensource.com>
List-subscribe:	<http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe:	<http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
Organization:	SolutionInc
References:	<2E89B96B-9E41-4CD3-884B-7E69090DC6C3@xxxxxxxxxxxxxxxxxx>
Sender:	xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent:	KMail/1.9.4

On Monday 02 October 2006 12:09 pm, Thomas wrote:
> Is there a recommended per guest configuration directive to specify
> the only IP allowed to traverse traffic (ingress/egress) via the
> virtual bridge to the domU?
>
> Current suggestions include MAC based ip access control at the layer
> 3 level, however I'd like to know if there is a more granular method
> of controlling IP based usage per guest, because it now appears that
> all IG/EG traffic over the switch port only sees the MAC address for
> dom0.
>
> E.g. netmask 10.0.0.0/24 limit guest domain to 10.0.0.10 and not
> allow traffic from any other source addresses on this netmask.

Use ebtables on xenbr0:

http://ebtables.sourceforge.net/

-- 
James Oakley
Engineering - SolutionInc Ltd.
joakley@xxxxxxxxxxxxxxx
http://www.solutioninc.com

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

[More with this subject...]

<Prev in Thread]	Current Thread	[Next in Thread>
[Xen-users] ip source access policy per domU, Thomas Re: [Xen-users] ip source access policy per domU, James Oakley <=

Previous by Date:	[Xen-users] /usr/sbin/mkinitrd: illegal option -- v, Anand Gupta
Next by Date:	Re: [Xen-users] /usr/sbin/mkinitrd: illegal option -- v, Hugo Brites
Previous by Thread:	[Xen-users] ip source access policy per domU, Thomas
Next by Thread:	[Xen-users] Memory allocation, Badyk, Benjamin
Indexes:	[Date] [Thread] [Top] [All Lists]