This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


RE: [Xen-users] Isolated network

>>> Sorry, I think I worded my post wrong. What I meant was is there a
>>> to make sure that the DomUs can't access the Dom0, i.e. so they
>>> are on an isolated network. By default in virt-manager, the Dom0
>>> gets attached to each bridge created...

>> Simply don't assign an IP to the bridge device in your dom0.

> And this is secure? Could I make it any better by using ebtables or
anything like that?

You may want to do other things like disable IP forwarding and make sure
there's nothing else on your network that will route from your domU to
your dom0 network.  If your dom0 doesn't have separate physical
interfaces, creating VLANs to segregate the networks is helpful.

I can't say whether this is bulletproof, since I don't follow much
research on Xen security.  But it's a starting point, and the one I
would choose.


Xen-users mailing list

<Prev in Thread] Current Thread [Next in Thread>