[Xen-users] Promiscuous mode

["Jonathan Tripathy" <jonnyt@xxxxxxxxxxx>]

Hi Everyone,

 

In order to prevent DomU from entering promiscuous mode, is it just a matter of adding these 2 rules when the vif is created?

 

# Accept packets leaving the bridge going to the domU only if
  #  the destination IP for that packet matches an authorized IPv4
  #  address for that domU.
  iptables -A FORWARD -m physdev --physdev-out vif1.0 \
    --destination 216.146.46.43 -j ACCEPT

  # Accept packets coming into the bridge leaving the physical
  #  network interface peth0 only if the source IP for that packet
  #  matches an authorized IPv4 address for that domU.  
  iptables -A FORWARD -m physdev --physdev-in vif1.0 \
    --physdev-out peth0 --source 216.146.46.43 -j ACCEPT

I got the above from http://www.standingonthebrink.com/index.php/ipv6-ipv4-and-arp-on-xen-for-vps/

Does that provide total protection? What about if traffic was going from Dom1 to Dom3, could Dom2 snoop in?

Thanks

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users