<div dir="ltr"><div><div><div><div>Hi Shahar,<br><br></div>Thanks, I need to work this out further to have it 100% visible.<br><br>I wonder why I was able in the past (3.1) to dedicate an NIC to a VM. <br><br></div>Do you also have an explanation why I cannot save a network configuration with a nic in DHCP mode ? It complains about a wrong IP and I have seen it should be a bug. Is this right ?<br>
<br></div>Cheers,<br><br></div>Matt<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">2013/2/10 Shahar Havivi <span dir="ltr"><<a href="mailto:shaharh@redhat.com" target="_blank">shaharh@redhat.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 10.02.13 14:13, Dan Kenigsberg wrote:<br>
> On Sun, Feb 10, 2013 at 12:19:57PM +0100, Matt . wrote:<br>
> > Hi,<br>
> ><br>
> > For setting up a firewall in a VM I would like to add 2 of my 4 nics<br>
> > directly to a VM.<br>
> ><br>
> > In my previous setup I thought I have done that, but at the moment I cannot<br>
> > figure this out and cannot find the docs to accomplish this.<br>
> ><br>
> > I would like to dedicate those 2 nics to my firewall VM's to avoid sharing<br>
> > them using a network per accident to other VM's.<br>
> ><br>
> > How is this be done at the moment ?<br>
><br>
> AFAIK it can be done only with a vdsm hook. You'd need to define your VM<br>
> with no interface at all, but instead, mark it with a special custom<br>
> property you define. Then, you should write a hook that adds the two<br>
> host interfaces to the VM, by means of either<br>
> <a href="http://libvirt.org/formatdomain.html#elementsNICSDirect" target="_blank">http://libvirt.org/formatdomain.html#elementsNICSDirect</a> or<br>
> <a href="http://libvirt.org/formatdomain.html#elementsNICSHostdev" target="_blank">http://libvirt.org/formatdomain.html#elementsNICSHostdev</a><br>
><br>
> Most probably, you would need to pin your firewall VM to a specific<br>
> host.<br>
><br>
> Writing a hook is not too complex, but it requires understanding of how<br>
> vdsm and libvirt works. You can take<br>
> <a href="http://gerrit.ovirt.org/gitweb?p=vdsm.git;a=tree;f=vdsm_hooks/vmfex" target="_blank">http://gerrit.ovirt.org/gitweb?p=vdsm.git;a=tree;f=vdsm_hooks/vmfex</a> as a<br>
> reference, or ask for specific guidance here.<br>
><br>
> Dan.<br>
</div></div>Dan is right,<br>
Currently you can do it via hook,<br>
We do have promisc mode but currently we have mirroring mode only (ie you can<br>
monitor each VM traffic but cannot intercept it).<br>
The way to do it is via layer 2.<br>
<br>
its best to implement after_vm_start hook and use ebtables.<br>
you can pass to the hook the network name.<br>
when you have the network name you can prob for its mac address and in the libvirt xml<br>
you can view the interfaces that are part of that network and get the mac<br>
addresses as well. (look at other hooks as Dan point out)<br>
<br>
when you have the network name the network mac and the target interface you<br>
can use ebtables:<br>
1. set the bridge in promisc mode<br>
$ ifconfig <netwok name> promisc<br>
2. traffic to the monitoring machine<br>
$ ebtables -t nat -A PREROUTING -d 00:1a:4a:16:01:51 -i eth0 -j dnat --to-destination 00:1a:4a:16:01:11<br>
3. traffic from the monitoring machine<br>
$ ebtables -t nat -A PREROUTING -s 00:1a:4a:16:01:51 -i vnet0 -j dnat --to-destination 00:1a:4a:16:01:11<br>
<br>
1. set the network interface in promiscous mode<br>
2. traffic that ment to the vm mac will go to the destination mac<br>
2. traffic that sent from the vm mac will go to the destination mac<br>
<br>
note that the -i <interface> is the interface name and I think it can be omitted...<br>
<span class="HOEnZb"><font color="#888888"><br>
Shahar Havivi.<br>
</font></span></blockquote></div><br></div>