On Thu, Jun 11, 2009 at 5:58 PM, Ross Vandegrift <ross@xxxxxxxxxxx> wrote:
2) Many VEs in many communities spread across many hosts. Forexample, it might get bad if you had 5 communities across 100 hosts,
with each community having 100 VEs. This would mean each host needs
a full set of 10000 MAC rules for each community - 50000 ebtables
rules. In this case, I'd again prefer a routed design (well, any case
actually...) and if a common "community" LAN was a software
requirement, I'd use multipoint GRE or L2TP.
But for one node with a bunch of unrelated VEs, this is very little
work to maintain.
In my particular configuration, there are no communities - each VE is an island, and will only be able to communicate with the network gateway (which is non-local, ie. not on the linux bridge itself.) That should lock down layer 2. With OpenVZ, each VE's MAC will have a common SWSoft 00:18:51 prefix.
After I get that working, I need to lock down layer 3 with iptables, so the PVLAN functionality can't be bypassed.
If you have any configuration examples for ebtables, especially simple ones, I would welcome them :)
Thanks,
Daniel
_______________________________________________ Bridge mailing list Bridge@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/bridge
