How can I prevent ip spoofing in KVM

[harmonyp]

I am seeking advise on how I can first identify which virtual machine is causing this and second how can I prevent this from happening again. I presume it is IP spoofing

iftop: https://i.gyazo.com/a748cf88760eac99f61378d1830d83b9.png

The IPs on the left 118.107.171.x are not owned by me and the same can be said by the IPs on the right side

I have identified who is responsible for this but it's mainly due to this graph https://i.gyazo.com/73d4977292ed4b670b05b19f6ab40eeb.png without this I would like to know how I could identify the culprit.


VMs connect through vmbr0

auto lo
iface lo inet loopback


iface eth0 inet dhcp


iface eth1 inet dhcp


iface eth2 inet dhcp


iface enp5s0f0 inet manual


iface enp5s0f1 inet manual


iface enp7s0f3u2u2c2 inet manual


auto vmbr0
iface vmbr0 inet static
        address 51.89.xxx.xxx/24
        gateway 51.89.xxx.254
        bridge-ports enp5s0f0
        bridge-stp off
        bridge-fd 0

 

[oguz]

hi,

you can check our documentation [0]

make sure you also enable firewall on datacenter level and VM level.

for identifying which VM is responsible,you can sniff packets for the vmbr0 interface to see which mac address is generating this traffic, and then check the VM configurations VM -> Hardware -> Network device to find which VM has that MAC

hope this helps!

[0]: https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html#pve_firewall_ipfilter_section

 

[harmonyp]

hi,

you can check our documentation [0]

make sure you also enable firewall on datacenter level and VM level.

for identifying which VM is responsible,you can sniff packets for the vmbr0 interface to see which mac address is generating this traffic, and then check the VM configurations VM -> Hardware -> Network device to find which VM has that MAC

hope this helps!

[0]: https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html#pve_firewall_ipfilter_section

Thank you for the reply. What should the firewall config look like for the VM if I only want to enable this ipfilter? I want all ports open, the firewall purpose would only be to prevent spoofing.

Also is there a way to apply rules to all VMs easily? maybe at the node level as the datacenter rules don't seem to do so.

 

[harmonyp]

Never mind after playing around with it I think I got it figured out I presume I don't have to do anything under VM > Firewall > IPSet

 

[guletz]

and second how can I prevent this from happening again

... good question!
One possible answer is to use PPPoE for this, as many ISPs used for the same reason.

Good luck / Bafta !