mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-09-09 17:24:53 +00:00
8c309caff8
With fragments borrowed from David Steven's previous submission and some further modifications: A set of modifications to filters to handle multiple IP addresses (and MAC addresses) per interface. Also: - enable DHCP traffic from VM to any DHCP server - will require an update to a libvirt-tck data file Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
31 lines
947 B
XML
31 lines
947 B
XML
<filter name='clean-traffic' chain='root'>
|
|
<!-- An example of a traffic filter enforcing clean traffic
|
|
from a VM by
|
|
- preventing MAC spoofing -->
|
|
<filterref filter='no-mac-spoofing'/>
|
|
|
|
<!-- preventing IP spoofing on outgoing, allow all IPv4 in incoming -->
|
|
<filterref filter='no-ip-spoofing'/>
|
|
|
|
<rule direction='out' action='accept' priority='-650'>
|
|
<mac protocolid='ipv4'/>
|
|
</rule>
|
|
|
|
<filterref filter='allow-incoming-ipv4'/>
|
|
|
|
<!-- preventing ARP spoofing/poisoning -->
|
|
<filterref filter='no-arp-spoofing'/>
|
|
|
|
<!-- accept all other incoming and outgoing ARP traffic -->
|
|
<rule action='accept' direction='inout' priority='-500'>
|
|
<mac protocolid='arp'/>
|
|
</rule>
|
|
|
|
<!-- preventing any other traffic than IPv4 and ARP -->
|
|
<filterref filter='no-other-l2-traffic'/>
|
|
|
|
<!-- allow qemu to send a self-announce upon migration end -->
|
|
<filterref filter='qemu-announce-self'/>
|
|
|
|
</filter>
|