Re: [Xen-users] Limit IPs on DomU

[John Haxby <john.haxby@xxxxxxxxxx>]

Sebastian Igerl wrote:
> I want to limit the IPs/Mac a DOMU can have.. 
> if a DomU uses an ip address other than i intended to do or  changes his
> MAC Address all packed should be dropped..
>   
ebtables (http://ebtables.sourceforge.net/) is good for this, but it is 
possible to use iptables under some conditions: 
http://ebtables.sourceforge.net/examples.html#ex_anti-spoof
You can extend the ebtables example to include a "--in-interface" match 
to pin the MAC/IP address pair to a specific device, but, of course, 
you'd have to do this at the time the domain is created.
I can't remember the circumstances under which iptables filtering will 
work, but I know it often doesn't because iptables doesn't see bridge 
traffic.  There's lots more about this in the ebtables documentation.
jch

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users