prevent sniffing

[tincboy]

I've many Proxmox servers in different zones,
In one of my zones I can sniff the some other VMs traffic with out any manipulation or tools installation, just the incoming packages are coming to other VMs interface,
Is there any kind of configuration to prevent this behavior?

 

[dietmar]

vlans. Or use multiple bridges

 

[tincboy]

I've to use single bridge and while the range of IPs are the same I can't use separate vlan for each VM.
Isn't there any way to filter packets by mac address?

 

[tincboy]

any help?

 

[spirit]

I think it should be possible to filter with ebtables
http://ebtables.sourceforge.net/documentation/features.html

In the long term, integration of openvswitch should correct this sniffing security problem. (as openvswitch is a switch and not a bridge)

 

[dietmar]

In the long term, integration of openvswitch should correct this sniffing security problem. (as openvswitch is a switch and not a bridge)

openvswitch is not really compatible with iptables, but does not provide a full iptables replacement. So I am not sure if openvswitch is the way to go.

 

[charnov]

iptables are not needed with Open vSwitch... you would use ovs-ofctl commands to set filters on ingress and egress. it seems weird but after you get used to it, it works great... http://openvswitch.org/pipermail/discuss/2012-May/007076.html

 

[dietmar]

iptables are not needed with Open vSwitch... you would use ovs-ofctl commands to set filters on ingress and egress.

So for examply, how do I set up DNAT with vSwitch?

 

[spirit]

So for examply, how do I set up DNAT with vSwitch?

Not sure for dnat,
but this article
http://www.zoobey.com/index.php/resources/all-articles-list/615-installing-openvswitch-in-centos-63
seem to say that we can use iptables


## Add Iptables NAT and Rules
iptables -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A INPUT -i ovsbr1 -j ACCEPT
iptables -A FORWARD -i ovsbr1 -j ACCEPT

 

[dietmar]

seem to say that we can use iptables

You assume they understand what they do ;-) Anyways, so far I have not seen any official docu on that topic.