On 29/08/10 18:34, Tomasz Chmielewski wrote:
On 29.08.2010 19:25, Jonathan Tripathy wrote:
Also, if I do this on the "rogue" guest (with MAC, IP belonging to the
"other" guest):
ifconfig eth0 hw ether AA:BB:CC:DD:EE:FF
ifconfig eth0 1.2.3.22
any communication to the "other" still breaks (from external hosts).
So, no improvement.
Why do you need to use the INPUT chain with ebtables in a VM
environment? In my ebtables setup, I have INPUT to drop everything,
except stuff from/to the loopback interface (lo)
I can use anything, as long as it "pins" given MAC/IP addresses to a
VM guest - and that any "rogue" guest is not able to disrupt traffic
to other VM guests (or, worse, the gateway) - i.e. by changing its own
IP/MAC to something else, possibly addresses used by other guests /
gateway.
Yes, but the INPUT chain is only relevant for traffic destined for the
host itself. Does the host actually do anything in your case, or is it
just a bridging device?
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
