This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-users] Isolated network

To: Jonathan Tripathy <jonnyt@xxxxxxxxxxx>
Subject: Re: [Xen-users] Isolated network
From: Florian Manschwetus <florianmanschwetus@xxxxxx>
Date: Fri, 04 Jun 2010 15:03:38 +0200
Cc: Xen-users@xxxxxxxxxxxxxxxxxxx
Delivery-date: Fri, 04 Jun 2010 06:05:11 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <46C13AA90DB8844DAB79680243857F0F062012@xxxxxxxxxxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <46C13AA90DB8844DAB79680243857F0F062012@xxxxxxxxxxxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv: Gecko/20100410 Thunderbird/3.0.4
Am 04.06.2010 11:14, schrieb Jonathan Tripathy:
> Hi everyone,
> I wish to create an isolated network that only a few DomUs can access.
> The Dom0 must not have access to this network. Public IP address will be
> routed via this isolated network, so security is important.
If you like to have network which is by no means accessible by dom0,
this impossible. Afaik, this is also true for remote exec exploits
against dom0 networkstack.
Maybe (not sure if this is possible) you could delegate the network
handling to another udom, but then the root of this udom would be able
to access these networks.
What but it is possible to use an interface as bridge target without
assigning an ip address.
> When you create a "Virtual Network" with virt-manager, it gives the new
> bridge an ipaddress..
No idea here, I configure my networking manually, so the
mac=[MAC],bridge=eth0 form is, what I'm talking about.
> Any ideas on how I could create this internal network just for the
> DomUs? Is it just a matter of removing the IP address from the bridge?
Depending on your needs crossbow maybe closer to your opinions.
A look at opensolaris as dom0 might be useful if you plan more complex
security related network setups in your virtual environment.


Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

Xen-users mailing list
<Prev in Thread] Current Thread [Next in Thread>