On 28 Jul 2017, at 22:52, Remco Barendse <[email protected]> wrote:
> I have a server who's only purpose is to run a bunch of virtualized guests
> (libvirt/kvm).
> The server has 4 NIC's that are all bridged. 2 are connected to internet, 2
> to private lan.
> The guests have their own firewall and get their ip either fixed or from a
> DHCP elsewhere on the network, some guests have 2 NIC's assigned, one to
> local lan and one with a public ip (for example NIC1 is assigned to br0 +
> NIC2 is assigned to br2.
> Only one bridge has an ip address assigned (on a local lan) so i can SSH into
> the virtual host from the local lan, the host doesn't need connection to the
> internet itself.
>
> This is the setup:
> NIC Bridge + IP Connected to
> eth0 br0 10.1.0.10 10.1.0.0/8
> eth1 br1 - 192.168.178.0/24
> eth2 br2 - internet ISP1
> eth3 br3 - internet ISP2
>
> I am not worried about traffic flowing between guests on a bridge, and the
> virtual host doesn't have a ipv4/ipv6 address assigned to it on any of the
> other interfaces but I guess firewall the virtual host is a good thing to do.
On my Xen hosts at work I decided that Shorewall was probably not the most
appropriate tool to use given the dynamic nature of virtual NICs etc and the
simple rules I needed. Just thrown into a script in /etc/init.d/firewall and
linked to /etc/rcn.d as appropriate.
START
# Set traffic not addressed to us to no-track
# t:raw c:prerouting
/sbin/iptables -t raw -A PREROUTING --in-interface ethext ! --dst
$ExtAdd -j NOTRACK
# filter:inbound
# t:filter c:inbound-ext & inbound-bak
/sbin/iptables -t filter --new inbound-ext
# allow established streams (ie outbound initiated connections)
/sbin/iptables -t filter -A inbound-ext -m state --state
RELATED,ESTABLISHED -j ACCEPT
# allow icmp
/sbin/iptables -t filter -A inbound-ext --src nn.nn.nn.nn/nn -p icmp
--icmp-type 8 -j ACCEPT
/sbin/iptables -t filter -A inbound-ext -p icmp --icmp-type 8 -m limit
--limit 6/minute --limit-burst 10 -j ACCEPT
/sbin/iptables -t filter -A inbound-ext -p icmp --icmp-type 8 -j DROP
/sbin/iptables -t filter -A inbound-ext -p icmp -j ACCEPT
# allow ssh
/sbin/iptables -t filter -A inbound-ext --src nn.nn.nn.nn/nn -p tcp
--dport 22 -j LOG --log-level info --log-prefix "FW net2fw"
/sbin/iptables -t filter -A inbound-ext --src nn.nn.nn.nn/nn -p tcp
--dport 22 -j ACCEPT
# drop everything else
/sbin/iptables -t filter -A inbound-ext -j DROP
# filter: send inbound packets to us to chain inbound-[ext|xxx|xxx]
# t:filter c:INPUT
# policy allow
/sbin/iptables -t filter -A INPUT --dst $ExtAdd -j inbound-ext
STOP
/sbin/iptables -F
/sbin/iptables -F -t raw
/sbin/iptables -X inbound-ext
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
