<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi,<br>
<br>
I don't know if this is much help but here is our setup which
works in a way that users cannot spoof public IP from inside VM.<br>
We've set up a MAC pool range on engine and a DHCP server on one
VM, this server assigns IPs according to VMs MACs.<br>
We use CentOS6 nodes (and engine 3.3.5). The node always sees the
VM's NIC by it's ovirt MAC, even if user changes it from inside
VM.<br>
Now the solution was ebtables (bridge tables). We've set rules on
bridge to public network which drops packets if they don't come
from legit MAC/IP combination. Example:<br>
<br>
-A FORWARD -p IPv4 -s 0:1a:4a:f9:xx:xx --ip-src ! IPADDRofVM -j
DROP<br>
<br>
Any comments on the setup are appriceated.<br>
<pre class="moz-signature" cols="72">JureKr
</pre>
On 06/19/2014 10:23 AM, Punit Dambiwal wrote:<br>
</div>
<blockquote
cite="mid:CAGZcrB=DyZ220HcXzCQ47=uSy5a-vjB5S4_C8eSMv8-Y9D-tXw@mail.gmail.com"
type="cite">
<div dir="ltr">Hi,
<div><br>
</div>
<div>I have setup Ovirt with glusterfs...I have some concern
about the network part....</div>
<div><br>
</div>
<div>1. Is there any way to restrict the Guest VM...so that it
can be assign with single ip address...and in anyhow the user
can not manipulate the IP address from inside the VM (that
means user can not change the ip address inside the VM).</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Punit </div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@ovirt.org">Users@ovirt.org</a>
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/mailman/listinfo/users">http://lists.ovirt.org/mailman/listinfo/users</a>
</pre>
</blockquote>
<br>
</body>
</html>