Score:1

Server

On KVM VM, block egress to other IPs on local net while allowing ingress. Allow in/out to Internet. And do it without a firewall

Bertel

4/30/23, 2:24 PM

I am (very carefully) thinking of opening one of my VMs (all on KVM) to outside access. Currently, only via cloudflared tunnel, but it could change. For that, I need a way to definitely and securely block access from that specific VM to any and all hosts on the private network, just in case someone breaks in and gets root. That specific VM (let’s call it VM10) should only have access to the gateway, and from there to the Internet. At the same time, I want to be able to access that specific VM from an IP on the private network(s) for maintenance, backup, and further development. I am using bridges.

VM10 is connected via br1 and br2.

Br1 connects to the Internet. Br2 is a high speed private network.

On VM10, eth0 connects to br1 with IP 192.168.1.10 ; eth2 connects to br2 with IP 192.168.222.10

Anyone logged into VM10, even with root access, should only be able to reach 192.168.1.1, and the Internet beyond. Anyone logged into VM10, even with root access, should not be able to reach anything at all via eth2. Preferably, eth2 should not even show up when on is logged into VM10.

I do not want to do that with a firewall rule on VM10, because if someone gets root on VM10, the firewall will be down in seconds.

I do not want to do it with firewall rules in boxes on the private networks, because it is a hassle, an easily overlooked. I want to stick something into the XML of VM10, and be done with it.

For VM10:

Allow ingress and egress to/from 192.168.1.1 and the Internet.
Disallow egress to any other ips on br1. Allow ingress.
Disallow egress to all ips on br2. Allow ingress.
Do this in a way so that it cannot be changed by a root user logged into VM10

I think libvirt's network filters can do that, but I am afraid their documentation is too dense a subject for my old head.

Could a kind soul help out? Possibly, with a complete rule?

Thank you.

0 + 0

iptables

kvm-virtualization

Nikita Kipriyanov

4/30/23, 6:46 AM

Don't you see the obvious disrepancy between at least Wikipedia definition and the fact your router has "a DMZ entry"? This is wrong. DMZ is a whole network segment (or several). The router you mentioned calls a "catch-all destination" a DMZ, which is wrong and contradicts the definition of DMZ. In other words, what is "DMZ" in your router is not a true DMZ, but some kind of grimmik. Also, read the whole article, please, that's a good introduction into what it is, and you'll see it is essentially about you are going to implement. I'll say it again: you are reinventing DMZ in your question.

Nikita Kipriyanov

4/30/23, 6:52 AM

Also notice various network implementation of DMZs as [diagrams](https://www.google.com/search?q=dmz&tbm=isch&source=iu&ictx=1). None of them suggest a possibility to have a single entry in the router and call that a DMZ.

Bertel

4/30/23, 12:10 PM

I give up, you are absolutely right.

Nikita Kipriyanov

4/30/23, 4:31 PM

Directly implementing what you want is impossible. I though about network namespaces, but that's still not bulletproof. What you need actually is called DMZ. You put your VM10 into DMZ and have all the internetwoking security implemented via the gateway with at least three IP interfaces (WAN, LAN and DMZ). The gateway itself should be is properly secured, but that's another topic.

Bertel

4/30/23, 5:24 PM

I'm sorry, DMZ is very bad advice. Usually, the only thing you should point your DMZ at (if you insist) is a honeypot. Pointing the DMZ at VM10 does not solve any of the above, except creating headaches.

Nikita Kipriyanov

4/30/23, 6:25 PM

Pardon me, "pointing"? DMZ is not a thing that could be "pointed". You seem to think of DMZ as a "catch-all destination", but this is totally wrong. The [DMZ](https://en.wikipedia.org/wiki/DMZ_(computing)) is a network area which is partially accessible from the Internet, accessible from the LAN, but LAN is inaccessible from it. You are essentially trying to reinvent the same concept, but with inappropriate tools and contradictory requirements. I just suggested an appropriate, industry standard tool.

Bertel

4/30/23, 9:28 PM

According to the all-knowing Wikipedia, "In computer security, a DMZ or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted, usually larger, network such as the Internet." So if I would point the DMZ entry in my router at VM10's 192.168.222.10, any and all traffic would be sent to 192.168.222.10 ... at least where I grew up. Again, extremely bad, even dangerous advice.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: On KVM VM, block egress to other IPs on local net while allowing ingress. Allow in/out to Internet. And do it without a firewall

TH: บน KVM VM ให้บล็อกขาออกไปยัง IP อื่นๆ บนเครือข่ายท้องถิ่นในขณะที่อนุญาตให้เข้าได้ อนุญาตให้เข้า / ออกอินเทอร์เน็ตและทำได้โดยไม่ต้องใช้ไฟร์วอลล์

RO: Pe VM KVM, blocați ieșirea către alte IP-uri de pe rețeaua locală, permițând în același timp intrarea. Permite intrare/ieșire la Internet.Și fă-o fără firewall

RU: На KVM VM заблокируйте выход на другие IP-адреса в локальной сети, разрешив вход. Разрешить вход/выход в Интернет.И сделать это без брандмауэра

VI: Trên KVM VM, chặn lối ra tới các IP khác trên mạng cục bộ trong khi cho phép lối vào. Cho phép vào/ra Internet.Và làm điều đó mà không cần tường lửa

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.