Re: Confusion about filtering traffic in a bridge scenario

[Gáspár Lajos <swifty@xxxxxxxxxxx>]

Hi Marc,

2012-04-11 16:58 keltezéssel, Marc írta:
> Hello,
>
> I was/am trying to setup packet filtering on a virtualisation host and
> couldnt get it to work and was hoping for some pointers.
>
> Heres the setup:
>
> Said host has:
> eth0 - the physical interface, no address assigned
> br0 - the bridge interface, has IP 10.0.0.1 and gateway and default
> route assigned to it
> veth0 - the virtual interface for one of the VMs, has IP 192.168.0.1
>
> both eth0 and veth0 are added to the bridge, the networking setup is
> functional, however I seem to be unable to filter traffic to the VM with
> iptables. Heres what Ive tried:
If I were you, I would set up my network as follows:

Real network
- eth0: IP: 10.0.0.1 Gateway: w.x.y.z

Virtual network
- br0:  IP:192.168.0.254 (this is the "internal" "network" of VMs)
- veth0: IP: 192.168.0.1 Gateway: 192.168.0.254 (a virtual interface of 
a VM)

The VMs would see your host as a gateway... With this setup you can 
simply use the FORWARD chain for NAT/filter/etc....

Swifty
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html