RE: [Xen-users] Isolated network

[Jeff Sturm <jeff.sturm@xxxxxxxxxx>]

>>> Sorry, I think I worded my post wrong. What I meant was is there a
way
>>> to make sure that the DomUs can't access the Dom0, i.e. so they
>>> are on an isolated network. By default in virt-manager, the Dom0
>>> gets attached to each bridge created...

>> Simply don't assign an IP to the bridge device in your dom0.

> And this is secure? Could I make it any better by using ebtables or
anything like that?

You may want to do other things like disable IP forwarding and make sure
there's nothing else on your network that will route from your domU to
your dom0 network.  If your dom0 doesn't have separate physical
interfaces, creating VLANs to segregate the networks is helpful.

I can't say whether this is bulletproof, since I don't follow much
research on Xen security.  But it's a starting point, and the one I
would choose.

-Jeff



_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users