KVM Guest Network Isolation
Edited: 2022-06-30, added capability to block multiple subnets. First things first! 1 2 mkdir -p ~/Bench/libvirt-nwfilter-test cd ~/Bench/libvirt-nwfilter-test Preface Until I learn how to tame VXLAN for a virtualization cluster, I need a dirty way of seperating infrastructure network and the VM network. The solution presented in this post is to apply libvirt’s network filters (nwfilter) to drop packages from and to the “uplink”, namely home LAN (10.0.0.0/18), for any guest connected to the NAT (192.168.123.0/24). This approach is analogous to setting firewall rules on a router, it just is virtual. Remember to adjust your subnets! ...