[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-users] Virtual Air Gap

On Mon, Dec 22, 2014 at 7:06 AM, CHATLINE UCR <ucrchatline@xxxxxxxxx> wrote:
> Is a virtual air gap possible where dom0 is not connected to the
> internet but domU is? For instance if I set dev eth0 down, is there
> a configuration where domU can still connect to the internet? If so,
> what additional steps should I take when setting up xenbridge, or is
> a bridge needed at all? If not, can I pass through the NIC to some
> domU and make a xenbridge between the other domUs, keeping dom0
> offline?

It's possible to passthru a nic to domU
It's also possible to have a bridge with no ip on dom0 side.

> I know it's possible to keep a domU offline, but if dom0 is
> compromised, is an attack on that domU easier?

yep. similar to the way it would be on physical server setup if
someone managed to compromise your centralized SAN, router, and
console (e.g. kvm over ip)


Xen-users mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.