How to prevent a host machine from sending/receiving packets with the following network configuration:
eth0
- physical NIC :: not configured;
tun0
- virtual NIC for VM which role is the gateway for other VMs :: auto configured (dhcp
), has Internet access, receives ip from the router (192.168.1.1/24
);
tun1
- virtual NIC, the gateway for other VMs :: 10.0.2.1/24
, dhcpd
, iptables with NAT
masquerading 10.0.2.0/24 through tun0 (which is eth0
in the guest VM)
bridge0
- bridge that includes eth0
and tun0
:: not configured
bridge1
- bridge that includes all VMs virtual NICs (tun{1...}) :: auto configured, receives ip from the gateway's VM dhcpd (10.0.2.1
), but default route through 10.0.2.1
is deleted.
I want to completely isolate my host machine from the external network (Internet in my case). And I need to access VMs network 10.0.2.0/24
. So the route table on the host machine looks like:
Destination Gateway Genmask Flags Metric Ref Use Iface
10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 br1
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
127.0.0.0 127.0.0.1 255.0.0.0 UG 0 0 0 lo
But there is one VM that is the gateway to Internet for other VMs, but not for the host (which is part of 10.0.2.0/24 network). I'm interested if deleting the default gw is sufficient or some smart software running in user-space can detect that 10.0.2.1
is the gateway to Internet and Linux kernel allows to route to unknown hosts through that.