Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How to prevent a host machine from sending/receiving packets with the following network configuration:

eth0 - physical NIC :: not configured;

tun0 - virtual NIC for VM which role is the gateway for other VMs :: auto configured (dhcp), has Internet access, receives ip from the router (192.168.1.1/24);

tun1 - virtual NIC, the gateway for other VMs :: 10.0.2.1/24, dhcpd, iptables with NAT masquerading 10.0.2.0/24 through tun0 (which is eth0 in the guest VM)

bridge0 - bridge that includes eth0 and tun0 :: not configured

bridge1 - bridge that includes all VMs virtual NICs (tun{1...}) :: auto configured, receives ip from the gateway's VM dhcpd (10.0.2.1), but default route through 10.0.2.1 is deleted.

I want to completely isolate my host machine from the external network (Internet in my case). And I need to access VMs network 10.0.2.0/24. So the route table on the host machine looks like:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 br1
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
127.0.0.0       127.0.0.1       255.0.0.0       UG    0      0        0 lo

But there is one VM that is the gateway to Internet for other VMs, but not for the host (which is part of 10.0.2.0/24 network). I'm interested if deleting the default gw is sufficient or some smart software running in user-space can detect that 10.0.2.1 is the gateway to Internet and Linux kernel allows to route to unknown hosts through that.

share|improve this question
    
Is a test VLAN option available to you? –  Colyn1337 Oct 10 '13 at 19:34
add comment

2 Answers

on IP layer the host machine will not receive nor transmit anything. However, on layer 2 and below it will see all traffic. What is your real objective?

share|improve this answer
add comment

I would accomplish this with a VLAN. There's a good explanation of VLANS on the serverfault.com site here:

How to set up VLAN network

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.