LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Virtualization and Cloud
User Name
Password
Linux - Virtualization and Cloud This forum is for the discussion of all topics relating to Linux Virtualization and Linux Cloud platforms. Xen, KVM, OpenVZ, VirtualBox, VMware, Linux-VServer and all other Linux Virtualization platforms are welcome. OpenStack, CloudStack, ownCloud, Cloud Foundry, Eucalyptus, Nimbus, OpenNebula and all other Linux Cloud platforms are welcome. Note that questions relating solely to non-Linux OS's should be asked in the General forum.

Notices

Reply
 
Search this Thread
Old 03-31-2012, 06:03 AM   #1
ericson007
Member
 
Registered: Sep 2004
Location: Japan
Distribution: CentOS 6.5
Posts: 481

Rep: Reputation: 85
KVM/libvirt - all traffic from eth0 to virtual guest


Hi there all.

I am battered trying to get this going. I am trying to set up a firewall distro on a kvm guest, up to here it is all good and no problems.

I would like to have all traffic from eth0 pass through the guest running a firewall, but at the same time prevent the host being accessable without traffic first passing over the firewall guest.

/ other guests and vm host
eth0 <-> guest funning firewall <->
\ eth1

The simplest solution is to use vt-d but unfortunately the MOBO only has a beta BIOS firmware to enable vt-d, not ideal for an eventual production environment.

What would you guys recommend?

Last edited by ericson007; 03-31-2012 at 06:05 AM.
 
Old 03-31-2012, 07:29 AM   #2
ericson007
Member
 
Registered: Sep 2004
Location: Japan
Distribution: CentOS 6.5
Posts: 481

Original Poster
Rep: Reputation: 85
Just a quick update to see if anyone can advise on my though process.

Currently thinking best way to go is to set up a bridge using eth0 and then somehow create ebtables rule sets to drop all packets destined for the host virtual machine and pass everything onto the firewalling guest vm.

Please critique.
 
Old 04-02-2012, 04:32 AM   #3
dyasny
Member
 
Registered: Dec 2007
Location: Canada
Distribution: RHEL,Fedora
Posts: 827

Rep: Reputation: 91
a bridge is the only way to do this right, and yes, you'll need to use ebtables to configure the fine details
 
1 members found this post helpful.
Old 04-02-2012, 09:43 PM   #4
ericson007
Member
 
Registered: Sep 2004
Location: Japan
Distribution: CentOS 6.5
Posts: 481

Original Poster
Rep: Reputation: 85
Thanks for the pointers in the right direction. Got it working.

After spending hours trying to configure different things, I found this article. Great for this type of setup for others like me not that proficient with the virtualization and virtualized networking aspects as of yet.

http://glycogen.net/2012/03/19/setup...fsense-router/

In the article, the author states that you have to disable SELinux, DO NOT DO THIS. I believe he had problems running iso images as install sources. Just relable the files to have the correct SELinux context
Quote:
chcon -R --reference=/var/lib/libvirt/images/ /lib/libvirt/images
or
Quote:
chcon --reference=/var/lib/libvirt/images/ /lib/libvirt/images/file.iso
(if you only want to relable a single file)

Please note that it is for setting up a very basic iptables ruleset on the host VM, but it will get the traffic passed properly. Make sure to revise the rules for production systems.

Now, I can endulge in learning how to use pfsense(network and guest vm guests) as well as shorewall(vm host firewall).
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Virtual XP guest shuts down when spice client disconnects from qemu-kvm allend Slackware 3 03-22-2012 09:34 AM
libvirt/kvm: Enter passphrase during guest startup using virsh start <domain> druuna Linux - Virtualization and Cloud 0 09-29-2011 06:59 AM
LXer: Set up Ubuntu 11.04 KVM to run is spice session on Fedora 14 KVM Server ( Libvirt Preview Env) LXer Syndicated Linux News 0 03-20-2011 12:00 AM
Read guest virtual memory in KVM raghu2383 Linux - Virtualization and Cloud 0 11-29-2010 04:08 AM
[SOLVED] Qemu kvm : No eth0 inside a Slackware-13.0 guest, although listed in lspci and lsmod Linux.tar.gz Slackware 9 02-08-2010 06:36 PM


All times are GMT -5. The time now is 01:11 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration