How to prevent a host machine from sending/receiving packets with the following network configuration:

eth0 - physical NIC :: not configured;

tun0 - virtual NIC for VM which role is the gateway for other VMs :: auto configured (dhcp), has Internet access, receives ip from the router (;

tun1 - virtual NIC, the gateway for other VMs ::, dhcpd, iptables with NAT masquerading through tun0 (which is eth0 in the guest VM)

bridge0 - bridge that includes eth0 and tun0 :: not configured

bridge1 - bridge that includes all VMs virtual NICs (tun{1...}) :: auto configured, receives ip from the gateway's VM dhcpd (, but default route through is deleted.

I want to completely isolate my host machine from the external network (Internet in my case). And I need to access VMs network So the route table on the host machine looks like:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   U     0      0        0 br1       U     0      0        0 lo       UG    0      0        0 lo

But there is one VM that is the gateway to Internet for other VMs, but not for the host (which is part of network). I'm interested if deleting the default gw is sufficient or some smart software running in user-space can detect that is the gateway to Internet and Linux kernel allows to route to unknown hosts through that.

  • Is a test VLAN option available to you?
    – Colyn1337
    Commented Oct 10, 2013 at 19:34

2 Answers 2


on IP layer the host machine will not receive nor transmit anything. However, on layer 2 and below it will see all traffic. What is your real objective?


I would accomplish this with a VLAN. There's a good explanation of VLANS on the serverfault.com site here:

How to set up VLAN network

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .