Re: [Xen-users] Virtual Air Gap

["Fajar A. Nugraha" <list@xxxxxxxxx>]

On Mon, Dec 22, 2014 at 7:06 AM, CHATLINE UCR <ucrchatline@xxxxxxxxx> wrote:
> Is a virtual air gap possible where dom0 is not connected to the
> internet but domU is? For instance if I set dev eth0 down, is there
> a configuration where domU can still connect to the internet? If so,
> what additional steps should I take when setting up xenbridge, or is
> a bridge needed at all? If not, can I pass through the NIC to some
> domU and make a xenbridge between the other domUs, keeping dom0
> offline?

It's possible to passthru a nic to domU
It's also possible to have a bridge with no ip on dom0 side.

> I know it's possible to keep a domU offline, but if dom0 is
> compromised, is an attack on that domU easier?

yep. similar to the way it would be on physical server setup if
someone managed to compromise your centralized SAN, router, and
console (e.g. kvm over ip)

-- 
Fajar

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users