[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-users] Promiscuous mode
Hi Everyone,
In order to prevent DomU from entering promiscuous
mode, is it just a matter of adding these 2 rules when the vif is
created?
# Accept packets leaving the bridge going to the domU only if # the destination IP for that packet matches an authorized IPv4 # address for that domU. iptables -A FORWARD -m physdev --physdev-out vif1.0 \ --destination 216.146.46.43 -j ACCEPT # Accept packets coming into the bridge leaving the physical # network interface peth0 only if the source IP for that packet # matches an authorized IPv4 address for that domU. iptables -A FORWARD -m physdev --physdev-in vif1.0 \ --physdev-out peth0 --source 216.146.46.43 -j ACCEPT I got the above from http://www.standingonthebrink.com/index.php/ipv6-ipv4-and-arp-on-xen-for-vps/ Does that provide total protection? What about if traffic was going from Dom1 to Dom3, could Dom2 snoop in? Thanks _______________________________________________ Xen-users mailing list Xen-users@xxxxxxxxxxxxxxxxxxx http://lists.xensource.com/xen-users
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |