This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


RE: [Xen-users] ip which is already being used can be taken bywindowsvps

To: "Nathan Eisenberg" <nathan@xxxxxxxxxxxxxxxx>, <xen-users@xxxxxxxxxxxxxxxxxxx>
Subject: RE: [Xen-users] ip which is already being used can be taken bywindowsvps
From: "James Harper" <james.harper@xxxxxxxxxxxxxxxx>
Date: Sun, 18 Oct 2009 18:48:10 +1100
Delivery-date: Sun, 18 Oct 2009 00:49:03 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <11B064048F34FD4094CBA16FC04BE21976739FB4@ex01>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <2f88f10c0910171335i431bb68ah5d103930990358a3@xxxxxxxxxxxxxx><AEC6C66638C05B468B556EA548C1A77D0177DA93@trantor> <11B064048F34FD4094CBA16FC04BE21976739FB4@ex01>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
Thread-index: AcpPaaNIlsyG3zAPStazlSGOhuEQcQAKMebAAAzy9cAAADfzUA==
Thread-topic: [Xen-users] ip which is already being used can be taken bywindowsvps
> > Some suggestions:
> >
> > 1. Make sure that anything that ever wants to talk to uses
> > so that it can never be impersonated. Make sure that you pay
> > if your ssh client ever complains that the key has changed.
> > 2. Put each VM on a /30 network and route everything to it. It might
> > a pain to maintain but it greatly reduces the attack surface.
> > 3. Use iptables to filter that port to make sure the source IP
> > is correct (remember to allow for DHCP queries if you use that -
> > will appear to come from I think).
> > 4. Install arpwatch (I think that's what it's called) that can
> > if
> > the relationship between a mac address and an IP address changes
> >
> > James
> >
> If you're going to do #2, you may as well use /31s and save 2 IPs per

I'm sure I read somewhere, once upon a time, that Windows just didn't
work with a /31. Could have been on the OpenVPN mailing list or docs
that I read it. I could also have imagined it :)

If you are using public IP addresses then by all means, try and use as
few as possible. If you are using private addresses though, I don't
think it's worth the fuss.


Xen-users mailing list