Virtual Guest MAC-Address Isolation

Virtual Guest MAC-Address Isolation

[Robert Rebstock]

(Partially reposted, as I screwed up while copy and pasting my configs; sorry for the noise.)

Hello all,

can anyone recommend a better way to achive (guest agnostic) MAC-address
isolation in qemu/kvm than with usermodes/slirp networking? It's too slow. 

I have multiple guests on the same host, all requiring identical MAC-addresses.

My current debian setup is as follows:

/etc/network/interfaces:

auto lo
iface lo inet loopback

auto br0
iface br0 inet static
        address 192.168.0.1
        netmask 255.255.255.0
        gateway 192.168.0.254
        metric 1
        bridge_ports eth0 eth1
        bridge_stp off
        bridge_fd 0
        bridge_maxwait 0
        post-up echo 600 > /proc/sys/net/ipv4/tcp_keepalive_time
        post-up echo 50 > /proc/sys/net/ipv4/tcp_keepalive_probes
        post-up echo 10 > /proc/sys/net/ipv4/tcp_keepalive_intvl

auto natbr0
iface natbr0 inet static
        address 10.0.2.2
        netmask 255.255.255.0
        metric 1
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0
        bridge_maxwait 0
        pre-up modprobe ip_conntrack_tftp
        pre-up modprobe ip_conntrack_ftp
        pre-up modprobe ip_nat_tftp
        pre-up modprobe ip_nat_ftp
        up echo "`route -n | sed -n 's/^0\.0\.0\.0 .* \(.*\)$/\1/p'`" > /var/run/${IFACE}_route
        up /usr/sbin/dnsmasq --interface=${IFACE}  --except-interface=lo --bind-interfaces --user=nobody \
        --dhcp-range=natbr0,10.0.2.15,10.0.2.15,255.255.255.0,10.0.2.255,72h \
        --domain=localnet --pid-file=/var/run/${IFACE}_dnsmasq.pid --conf-file
        up echo 1 > /proc/sys/net/ipv4/ip_forward
        up iptables -A FORWARD -s 10.0.2.0/24 -j ACCEPT
        up iptables -A FORWARD -d 10.0.2.0/24 -j ACCEPT
        post-up iptables -t nat -A POSTROUTING -o natbr0 -j MASQUERADE
        post-up echo 600 > /proc/sys/net/ipv4/tcp_keepalive_time
        post-up echo 50 > /proc/sys/net/ipv4/tcp_keepalive_probes
        post-up echo 10 > /proc/sys/net/ipv4/tcp_keepalive_intvl
        down iptables -D FORWARD -s 10.0.2.0/24 -j ACCEPT
        down iptables -D FORWARD -d 10.0.2.0/24 -j ACCEPT
        down iptables -t nat -D POSTROUTING -o natbr0 -j MASQUERADE
        post-down kill -s TERM `cat /var/run/${IFACE}_dnsmasq.pid` && rm -f /var/run/${IFACE}_dnsmasq.pid
        post-down rm -f /var/run/${IFACE}_route

where my "server boxes" are connected as:

/etc/qemu-kvm/qemu-ifup-br:
#!/bin/sh
BRIDGE=br0
/sbin/ifconfig $1 0.0.0.0 up
/usr/sbin/brctl addif $BRIDGE $1

if they need full connectivity,

or as:

/etc/qemu-kvm/qemu-ifup-natbr:

#!/bin/sh
BRIDGE=natbr0
/sbin/ifconfig $1 0.0.0.0 up
/usr/sbin/brctl addif $BRIDGE $1
/sbin/iptables -t nat -A POSTROUTING -o "`route -n | sed -n 's/^0\.0\.0\.0 .* \(.*\)$/\1/p'`" -j MASQUERADE || :

"hidden" behind NAT.

Only my "client boxes" (multiple virtual client boxes on the same server - currently setup using usermode networking) need identical MACs.
They don't need to "talk" to one another, but they do need to be able to talk to the servers and the "outside world".
 
I'm hoping that maybe someone that's a little more "network savvy" can give me a tip in the right direction.

vlans, ebtables, iptables, ppp, funky NAT setups, etc...

Thanks, and best regards,

Robert

PS. Please BCC me, as I am not on the list.

[Qemu-devel] Virtual Guest MAC-Address Isolation

[Robert Rebstock]

(Partially reposted, as I screwed up while copy and pasting my configs; sorry for the noise.)

Hello all,

can anyone recommend a better way to achive (guest agnostic) MAC-address
isolation in qemu/kvm than with usermodes/slirp networking? It's too slow. 

I have multiple guests on the same host, all requiring identical MAC-addresses.

My current debian setup is as follows:

/etc/network/interfaces:

auto lo
iface lo inet loopback

auto br0
iface br0 inet static
        address 192.168.0.1
        netmask 255.255.255.0
        gateway 192.168.0.254
        metric 1
        bridge_ports eth0 eth1
        bridge_stp off
        bridge_fd 0
        bridge_maxwait 0
        post-up echo 600 > /proc/sys/net/ipv4/tcp_keepalive_time
        post-up echo 50 > /proc/sys/net/ipv4/tcp_keepalive_probes
        post-up echo 10 > /proc/sys/net/ipv4/tcp_keepalive_intvl

auto natbr0
iface natbr0 inet static
        address 10.0.2.2
        netmask 255.255.255.0
        metric 1
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0
        bridge_maxwait 0
        pre-up modprobe ip_conntrack_tftp
        pre-up modprobe ip_conntrack_ftp
        pre-up modprobe ip_nat_tftp
        pre-up modprobe ip_nat_ftp
        up echo "`route -n | sed -n 's/^0\.0\.0\.0 .* \(.*\)$/\1/p'`" > /var/run/${IFACE}_route
        up /usr/sbin/dnsmasq --interface=${IFACE}  --except-interface=lo --bind-interfaces --user=nobody \
        --dhcp-range=natbr0,10.0.2.15,10.0.2.15,255.255.255.0,10.0.2.255,72h \
        --domain=localnet --pid-file=/var/run/${IFACE}_dnsmasq.pid --conf-file
        up echo 1 > /proc/sys/net/ipv4/ip_forward
        up iptables -A FORWARD -s 10.0.2.0/24 -j ACCEPT
        up iptables -A FORWARD -d 10.0.2.0/24 -j ACCEPT
        post-up iptables -t nat -A POSTROUTING -o natbr0 -j MASQUERADE
        post-up echo 600 > /proc/sys/net/ipv4/tcp_keepalive_time
        post-up echo 50 > /proc/sys/net/ipv4/tcp_keepalive_probes
        post-up echo 10 > /proc/sys/net/ipv4/tcp_keepalive_intvl
        down iptables -D FORWARD -s 10.0.2.0/24 -j ACCEPT
        down iptables -D FORWARD -d 10.0.2.0/24 -j ACCEPT
        down iptables -t nat -D POSTROUTING -o natbr0 -j MASQUERADE
        post-down kill -s TERM `cat /var/run/${IFACE}_dnsmasq.pid` && rm -f /var/run/${IFACE}_dnsmasq.pid
        post-down rm -f /var/run/${IFACE}_route

where my "server boxes" are connected as:

/etc/qemu-kvm/qemu-ifup-br:
#!/bin/sh
BRIDGE=br0
/sbin/ifconfig $1 0.0.0.0 up
/usr/sbin/brctl addif $BRIDGE $1

if they need full connectivity,

or as:

/etc/qemu-kvm/qemu-ifup-natbr:

#!/bin/sh
BRIDGE=natbr0
/sbin/ifconfig $1 0.0.0.0 up
/usr/sbin/brctl addif $BRIDGE $1
/sbin/iptables -t nat -A POSTROUTING -o "`route -n | sed -n 's/^0\.0\.0\.0 .* \(.*\)$/\1/p'`" -j MASQUERADE || :

"hidden" behind NAT.

Only my "client boxes" (multiple virtual client boxes on the same server - currently setup using usermode networking) need identical MACs.
They don't need to "talk" to one another, but they do need to be able to talk to the servers and the "outside world".
 
I'm hoping that maybe someone that's a little more "network savvy" can give me a tip in the right direction.

vlans, ebtables, iptables, ppp, funky NAT setups, etc...

Thanks, and best regards,

Robert

PS. Please BCC me, as I am not on the list.