Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to prevent a host machine from sending/receiving packets with the following network configuration:

eth0 - physical NIC :: not configured;

tun0 - virtual NIC for VM which role is the gateway for other VMs :: auto configured (dhcp), has Internet access, receives ip from the router (;

tun1 - virtual NIC, the gateway for other VMs ::, dhcpd, iptables with NAT masquerading through tun0 (which is eth0 in the guest VM)

bridge0 - bridge that includes eth0 and tun0 :: not configured

bridge1 - bridge that includes all VMs virtual NICs (tun{1...}) :: auto configured, receives ip from the gateway's VM dhcpd (, but default route through is deleted.

I want to completely isolate my host machine from the external network (Internet in my case). And I need to access VMs network So the route table on the host machine looks like:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   U     0      0        0 br1       U     0      0        0 lo       UG    0      0        0 lo

But there is one VM that is the gateway to Internet for other VMs, but not for the host (which is part of network). I'm interested if deleting the default gw is sufficient or some smart software running in user-space can detect that is the gateway to Internet and Linux kernel allows to route to unknown hosts through that.

share|improve this question
Is a test VLAN option available to you? – Colyn1337 Oct 10 '13 at 19:34

on IP layer the host machine will not receive nor transmit anything. However, on layer 2 and below it will see all traffic. What is your real objective?

share|improve this answer

I would accomplish this with a VLAN. There's a good explanation of VLANS on the site here:

How to set up VLAN network

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.