This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-users] Re: Network isolation - PCI passthrough question

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] Re: Network isolation - PCI passthrough question
From: Jean Baptiste FAVRE <xen-users@xxxxxxxxxxx>
Date: Tue, 21 Dec 2010 09:17:47 +0100
Delivery-date: Tue, 21 Dec 2010 00:19:11 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <4D0FDC85.5000306@xxxxxxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <4D0F6353.9020305@xxxxxxxxxxx> <ienqak$hic$1@xxxxxxxxxxxxxxx> <4D0F6E75.9060704@xxxxxxxxxxx> <ienv5g$bdh$1@xxxxxxxxxxxxxxx> <4D0F8314.4020908@xxxxxxxxxxx> <ieo1ei$nnd$1@xxxxxxxxxxxxxxx> <4D0FB526.6080906@xxxxxxxxxxxxxxx> <4D0FCE60.4030500@xxxxxxxxxxx> <4D0FDC85.5000306@xxxxxxxxxxxxxxx>
Reply-to: xen-users@xxxxxxxxxxxxxxxxxxx
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv: Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7
Le 20/12/2010 23:45, dave a écrit :
>> As far as I have seen, there are no way to attach domU nic directly to
>> my firewall domU. So, dom0 will always have access to network traffic
>> from domU, right ?
> only if you add dom0 interface to bridge.  for example:
> domu-2  :  tap2  --|
> domu-1  :  tap1  --|
> domu-fw :  tapfw --|
>                    |
>               tap-br0
>                    |
> dom0    :  tap0  --|
> so only do
> brctl addif tap-br0 tap0
> when dom0 needs to join the LAN, then
> brctl delif tap-br0 tap0
> when you want dom0 to leave the LAN.
> Again, I'm not sure if this is what you're trying to do, but it will
> isolate dom0 from your virtual LAN.

I understand what you mean. But even if dom0 has no interface bridged, I
think I'll be able to listen to network traffic, no ?

That is, a tcpdump -i tap-br0 will display network traffic from domU,
right ?
Then, what if I want to block that ? Will I have to use VPN (either SSL
or IPSEC) in order to make dom0 unable to listen for traffic ? Is it
realistic ?

I want to mitigate consequences if dom0 get compromised, that's why I'm
trying to isolate network.

Thanks for all explanations, I've many things to test now :)


Xen-users mailing list