On 29.08.2010 19:25, Jonathan Tripathy wrote:
Also, if I do this on the "rogue" guest (with MAC, IP belonging to the
"other" guest):
ifconfig eth0 hw ether AA:BB:CC:DD:EE:FF
ifconfig eth0 1.2.3.22
any communication to the "other" still breaks (from external hosts).
So, no improvement.
Why do you need to use the INPUT chain with ebtables in a VM
environment? In my ebtables setup, I have INPUT to drop everything,
except stuff from/to the loopback interface (lo)
I can use anything, as long as it "pins" given MAC/IP addresses to a VM
guest - and that any "rogue" guest is not able to disrupt traffic to
other VM guests (or, worse, the gateway) - i.e. by changing its own
IP/MAC to something else, possibly addresses used by other guests / gateway.
--
Tomasz Chmielewski
http://wpkg.org
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
