Re: [Qemu-discuss] Networking and vlan

[Mike Lovell]

On 04/19/2012 01:30 AM, Valerio Pachera wrote:
> > ... (vlan) they do not extend outside of the individual qemu processes
> Ok, that's what I was trying to undestand.
>
> In other words, if a guest has two nics and I do not specify any vlan,
> each packet sent to a guest nic is received also from the other nic
> because
> > it also behaves like an ethernet hub
> That also means it doesn't matter if I use vlan ot not, a guest will
> always be able to ping the others on the same bridge and any host i
> the lan.
> To achive the my scope, I have to configure vlan on the guests.
> The only bad side of that is: if I let other people to manage the
> guest, they can chenge network configuration and get out of the vlan.
> That's why I would have like something host side.

another way of achieving this is to have multiple bridges on the host 
and the various guests connect to different bridges. this isolates 
guests from each other. you could then connect vlan interfaces on the 
host to the separate guest bridges. this would result in guests being on 
separate vlans in the physical network.

yet another way would be to use openvswitch instead of the standard 
linux bridge. openvswitch supports setting vlans on 'ports,' kind of 
like a managed ethernet switch would. you could then specify the 
different vlans there. openvswitch would require a 3.3+ kernel or 
building some out-of-tree modules.

and there are a few other options for achieving isolation of guests. it 
depends on your needs and how much you want to work at it. :)

mike