Martijn Lievaart a écrit :
Oscar N wrote:
The whole idea was to create multiple firewalls of one linuxbox, not only
2 but 20 or something like that.
One solution is ofcourse to don't run connection tracking at all, but it
would be nice to get it to work. Do anyone know if this would be way to
much work to implement? Otherwise I might get some time over to play with
this.
Have a look at User Mode Linux (UML). It allows to run virtual machines
with the least overhead of all virtaul machine mechanisms I know. I have
no idea how you have to do the plumbing to get the right packets to the
right VM, but I think it can be done.
If the plumbing involves the bridging of virtual ethernet TAP
interfaces, be aware that on a kernel with "Bridged IP/ARP packets
filtering" (CONFIG_BRIDGE_NETFILTER) enabled, by default the Netfilter
and conntrack of the host sees all the bridged IP traffic. See the
/proc/sys/net/bridge/bridge-nf-call-* sysctls to disable this.
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
