Re: RE: KVM static internal networking without host bridge interface (virbr)

Daniel via Users <users@xxxxxxxxxxxxxxxxx> · Thu, 1 Aug 2024 18:58:50 +0200

Thanks for your response. Setting up macvtap is not a feasible solution 
for our use case. Essentially our use case is that we have two VMs and 
for security reasons we want to isolate these VMs as much as possible, 
as they are handling potentially sensitive information. One of the VMs 
acts as gateway with internet access, the other VM is used by the user.

Given that potentially sensitive information is flowing between the two 
VMs, we want to prevent the host from being able to sniff on the traffic 
between the two VMs. Is that possible in any way? If so, how can we 
prevent the host to see traffic of the internal network?

On 20.07.24 19:59, Marc wrote:
How to set up an internal network between two KVM network interfaces
while using static networking (avoiding dnsmasq) and while avoiding a
host bridge interface (virbr)?

I am also not using any network config in libvirt. All hosts have same vlans and interfaces and I just use a macvtap on these interfaces.

* I would like to avoid the host `virbr2` interface. This is because
ideally package sniffers on the host such as tshark / wireshark would be
unable to see these packages following between an internal network
between two VMs.

every macvtap is different interface you can easily tcpdump on.

* dnsmasq on the host operating system or inside the VMs should also be
avoided in favor of static IP addresses.

I have this also

--
Daniel Winzen
Steinkaulstr. 47
52070 Aachen
Germany
Web: https://danwin1210.de/
E-Mail: daniel@xxxxxxxxxxxxx
Phone: +49 176 98819809
PGP-Key: https://danwin1210.de/pgp.txt

Attachment:
OpenPGP_signature.asc

Description: OpenPGP digital signature