Virtual Firewall

Virtual Firewall

[Phil Daws]

Hello,

have been trying to build a virtual firewall as a POC but having some difficulty with the networking aspect.  On the physical server I have a single NIC that is connected to the Internet with the IP XXX.XXX.XXX.10 and is bound to bridge0.  I created the first guest, as the firewall, and added a virtio interface with source type "Host device vnet (bridge0)".  At the guest OS level I assigned the NIC another public IP XXX.XXX.XXX.20 and was able to route quite happily to the Internet.  I then proceeded to add a second NIC to the firewall guest but this time using the default NAT network and gave it the address 192.168.1.1.  I then created another guest with the IP 192.168.1.2 with its default route being 192.168.1.1 and that could get out to the Internet as-well once the FORWARD+SNAT rules w
 ere added to iptables.

Now here in lies the problem.  I wish to add another network so that I end up with:

XXX.XXX.XXX.20 Public Facing
192.168.1.1    Private LAN
192.168.2.1    DMZ

So using virtual-manager I created two brand new networks called "PrivateLAN" and "DMZ" with the networks above.  I then removed the secondary interface from the firewall and added two new NICs, one being on the PrivateLAN and the other on the DMZ.  When I fired up the firewall and attempted to assign those IP addresses to the interfaces the response was:

[root@fw1 ~]# ifup eth1
Error, some other host already uses address 192.168.1.1.

[root@fw1 ~]# ifup eth2
Error, some other host already uses address 192.168.2.1.

Running an arping showed that the MAC for bridge0 already had those IPs registered ?!?!?  I am obviously missing a networking fundamental here and really would like some help.

If you have only one physical NIC how do you create multiple networks as above; that allows IPtables to control the traffic flow.

Any help gratefully appreciated.

Thanks.

Re: Virtual Firewall

[Andrew Cathrow]

----- Original Message -----
> From: "Phil Daws" <uxbod@splatnix.net>
> To: kvm@vger.kernel.org
> Sent: Thursday, March 14, 2013 10:53:43 AM
> Subject: Virtual Firewall
> 
> Hello,
> 
> have been trying to build a virtual firewall as a POC but having some
> difficulty with the networking aspect.  On the physical server I
> have a single NIC that is connected to the Internet with the IP
> XXX.XXX.XXX.10 and is bound to bridge0.  I created the first guest,
> as the firewall, and added a virtio interface with source type "Host
> device vnet (bridge0)".  At the guest OS level I assigned the NIC
> another public IP XXX.XXX.XXX.20 and was able to route quite happily
> to the Internet.  I then proceeded to add a second NIC to the
> firewall guest but this time using the default NAT network and gave
> it the address 192.168.1.1.  I then created another guest with the
> IP 192.168.1.2 with its default route being 192.168.1.1 and that
> could get out to the Internet as-well once the FORWARD+SNAT rules
> were added to iptables.
> 
> Now here in lies the problem.  I wish to add another network so that
> I end up with:
> 
> XXX.XXX.XXX.20 Public Facing
> 192.168.1.1    Private LAN
> 192.168.2.1    DMZ
> 
> So using virtual-manager I created two brand new networks called
> "PrivateLAN" and "DMZ" with the networks above.  I then removed the
> secondary interface from the firewall and added two new NICs, one
> being on the PrivateLAN and the other on the DMZ.  When I fired up
> the firewall and attempted to assign those IP addresses to the
> interfaces the response was:
> 
> [root@fw1 ~]# ifup eth1
> Error, some other host already uses address 192.168.1.1.
> 
> [root@fw1 ~]# ifup eth2
> Error, some other host already uses address 192.168.2.1.
> 
> Running an arping showed that the MAC for bridge0 already had those
> IPs registered ?!?!?  I am obviously missing a networking
> fundamental here and really would like some help.
> 
> If you have only one physical NIC how do you create multiple networks
> as above; that allows IPtables to control the traffic flow.
> 
> Any help gratefully appreciated.


This is well supported in libvirt [1]
If you don't want to use libvirt then you can at least run to test the rules that are created or look at the code.


[1] http://libvirt.org/firewall.html
> 
> Thanks.
> --
> To unsubscribe from this list: send the line "unsubscribe kvm" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: Virtual Firewall

[Phil Daws]

----- Original Message -----
From: "Andrew Cathrow" <acathrow@redhat.com>
To: "Phil Daws" <uxbod@splatnix.net>
Cc: kvm@vger.kernel.org
Sent: Thursday, 14 March, 2013 3:30:50 PM
Subject: Re: Virtual Firewall



----- Original Message -----


This is well supported in libvirt [1]
If you don't want to use libvirt then you can at least run to test the rules that are created or look at the code.


[1] http://libvirt.org/firewall.html
> 
> Thanks.
> --
> To unsubscribe from this list: send the line "unsubscribe kvm" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Thank you Andrew.  I believe the underlying problem is my understanding of how KVM handles network interfaces. You have bridge, macvtap, nat etc. All I wish todo is to have one physical bridged network and X+ virtual networks that can route through a single guest.  Is that impossible ? I don't think it is as I can do two networks with the default NAT.

Thanks.