WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-users

RE: [Xen-users] Promiscuous mode

> Mon, 14 Jun 2010 10:41:49 +0100 <jonnyt@xxxxxxxxxxx> wrote:
> Hi Everyone,

> In order to prevent DomU from entering promiscuous mode, is it just a matter of adding these 2 rules when the vif is created?

> # Accept packets leaving the bridge going to the domU only if
> # the destination IP for that packet matches an authorized IPv4
> # address for that domU.
> iptables -A FORWARD -m physdev --physdev-out vif1.0 \
--destination 216.146.46.43 -j ACCEPT

> # Accept packets coming into the bridge leaving the physical
> # network interface peth0 only if the source IP for that packet
> # matches an authorized IPv4 address for that domU.  
> iptables -A FORWARD -m physdev --physdev-in vif1.0 \
> --physdev-out peth0 --source 216.146.46.43 -j ACCEPT
> I got the above from http://www.standingonthebrink.com/index.php/ipv6-ipv4-and-arp-on-xen-for-vps/
> Does that provide total protection? What about if traffic was going from Dom1 to Dom3, could Dom2 snoop in?
> Thanks


I would think so, provided the rules above filter all traffic expect to/from a specific ip. Therefore if all domU are on separate ip networks the traffic should be on completely different networks too.


Look 'em in the eye: FREE Messenger video chat Chat Now!
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
<Prev in Thread] Current Thread [Next in Thread>