Isolating host machine from external network

Question

How to prevent a host machine from sending/receiving packets with the following network configuration:

eth0 - physical NIC :: not configured;

tun0 - virtual NIC for VM which role is the gateway for other VMs :: auto configured (dhcp), has Internet access, receives ip from the router (192.168.1.1/24);

tun1 - virtual NIC, the gateway for other VMs :: 10.0.2.1/24, dhcpd, iptables with NAT masquerading 10.0.2.0/24 through tun0 (which is eth0 in the guest VM)

bridge0 - bridge that includes eth0 and tun0 :: not configured

bridge1 - bridge that includes all VMs virtual NICs (tun{1...}) :: auto configured, receives ip from the gateway's VM dhcpd (10.0.2.1), but default route through 10.0.2.1 is deleted.

I want to completely isolate my host machine from the external network (Internet in my case). And I need to access VMs network 10.0.2.0/24. So the route table on the host machine looks like:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 br1
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
127.0.0.0       127.0.0.1       255.0.0.0       UG    0      0        0 lo

But there is one VM that is the gateway to Internet for other VMs, but not for the host (which is part of 10.0.2.0/24 network). I'm interested if deleting the default gw is sufficient or some smart software running in user-space can detect that 10.0.2.1 is the gateway to Internet and Linux kernel allows to route to unknown hosts through that.

Answer 1

on IP layer the host machine will not receive nor transmit anything. However, on layer 2 and below it will see all traffic. What is your real objective?

Answer 2

I would accomplish this with a VLAN. There's a good explanation of VLANS on the serverfault.com site here:

How to set up VLAN network