WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-users

Re: [Xen-users] IP blocking

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] IP blocking
From: Andy Smith <andy@xxxxxxxxxxxxxx>
Date: Mon, 6 Aug 2007 15:18:53 +0000
Delivery-date: Mon, 06 Aug 2007 08:16:51 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <20070806125846.GB14393@xxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
Openpgp: id=BF15490B; url=http://strugglers.net/~andy/pubkey.asc
References: <7fedbc910708060518s510357cdx7e3be43159616815@xxxxxxxxxxxxxx> <20070806125846.GB14393@xxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.13 (2006-08-11)
Hi,

On Mon, Aug 06, 2007 at 01:58:46PM +0100, Daniel P. Berrange wrote:
> On Mon, Aug 06, 2007 at 02:18:20PM +0200, shacky wrote:
> > How I can assing a given IP address to a given domU and force the user
> > of that domU to use that IP address and not all other?
> > I don't want the user to change the IP address of his virtual machine
> > in /etc/network/interfaces with one ore more IP addresses which are
> > not assigned to him.
> 
> In the dom0 make sure the kernel has
> 
>    net.bridge.bridge-nf-call-iptables = 1
> 
> This ensures that all traffic to/from the guest passes through the iptables
> rules in Dom0. You can then filter traffic from individual vifN.M interfaces
> associated with the guest to make sure its only sending data with the valid
> predefined IP address and MAC address you gave it.

You will most likely want to use ebtables to make sure that they do
not ARP for others IPs as well (iptables would stop the traffic
flowing but the ARP would still cause havoc on your network).

Cheers,
Andy

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
<Prev in Thread] Current Thread [Next in Thread>