Re: [Xen-users] Isolated network

[Florian Manschwetus <florianmanschwetus@xxxxxx>]

Am 04.06.2010 11:14, schrieb Jonathan Tripathy:
> Hi everyone,
>  
> I wish to create an isolated network that only a few DomUs can access.
> The Dom0 must not have access to this network. Public IP address will be
> routed via this isolated network, so security is important.
If you like to have network which is by no means accessible by dom0,
this impossible. Afaik, this is also true for remote exec exploits
against dom0 networkstack.
Maybe (not sure if this is possible) you could delegate the network
handling to another udom, but then the root of this udom would be able
to access these networks.
What but it is possible to use an interface as bridge target without
assigning an ip address.
>  
> When you create a "Virtual Network" with virt-manager, it gives the new
> bridge an ipaddress..
>  
No idea here, I configure my networking manually, so the
mac=[MAC],bridge=eth0 form is, what I'm talking about.
> Any ideas on how I could create this internal network just for the
> DomUs? Is it just a matter of removing the IP address from the bridge?
>  
Depending on your needs crossbow maybe closer to your opinions.
A look at opensolaris as dom0 might be useful if you plan more complex
security related network setups in your virtual environment.

Florian

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users