<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 10pt; color: #000000"><div>HI,</div><div><br data-mce-bogus="1"></div><div>this is finally what I did with openvswitch : </div><div><br data-mce-bogus="1"></div><div>ovs-ofctl del-flows vswitch-vps<br>ovs-ofctl add-flow vswitch-vps "in_port=PORT_GW ip actions=NORMAL"<br>ovs-ofctl add-flow vswitch-vps "in_port=PORT_GW arp actions=NORMAL"<br><br># default drop communication with HOST_A<br>ovs-ofctl add-flow vswitch-vps "in_port=PORT_HOST_A priority=38000 idle_timeout=0 action=drop"<br></div><div><br data-mce-bogus="1"></div><div><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;"># default drop communication with HOST_B</span><br style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff;"><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">ovs-ofctl add-flow vswitch-vps "in_port=PORT_HOST_B priority=38000 idle_timeout=0 action=drop"</span></div><div><br># Allow GW communication + Hypervisor<br>ovs-ofctl add-flow vswitch-vps "in_port=PORT_GW priority=39000 dl_type=0x0800 nw_src=IP_GW dl_src=<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">MAC_GW</span> idle_timeout=0 action=normal"<br>ovs-ofctl add-flow vswitch-vps "in_port=PORT_GW priority=38500 dl_type=0x0806 dl_src=MAC_GW idle_timeout=0 action=normal"<br><br># Allow HOST A<br>ovs-ofctl add-flow vswitch-vps "in_port=PORT_HOST_A priority=38400 dl_type=0x0800 nw_src=<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">IP_HOST_A</span> dl_src=<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">MAC_HOST_A</span> idle_timeout=0 action=normal"<br>ovs-ofctl add-flow vswitch-vps "in_port=<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">PORT_HOST_A</span> priority=38300 dl_type=0x0806 dl_src=MAC_HOST_A idle_timeout=0 action=normal"</div><div><br></div><div># Allow HOST B<br>ovs-ofctl add-flow vswitch-vps "in_port=<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">PORT_HOST_B</span> priority=38400 dl_type=0x0800 nw_src=IP_HOST_B dl_src=MAC_HOST_B idle_timeout=0 action=normal"<br>ovs-ofctl add-flow vswitch-vps "in_port=<span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 13.3333px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none; background-color: #ffffff;">PORT_HOST_A</span> priority=38300 dl_type=0x0806 dl_src=MAC_HOST_B idle_timeout=0 action=normal"<br></div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>To find port numbers: </div><div><br data-mce-bogus="1"></div><div>ovs-ofctl show BRIDGE</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div data-marker="__SIG_PRE__"><div><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif;">Cordialement,</span><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><br></span></span></div><div><br></div><div><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;">Benoît Georgelin -</span><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><br></span><span data-mce-style="color: #c0c0c0; font-weight: bold; font-size: xx-small;" style="color: #c0c0c0; font-weight: bold; font-size: xx-small;" size="1"><span style="font-family: times new roman,new york,times,serif; font-style: italic;" data-mce-style="font-family: times new roman,new york,times,serif; font-style: italic;">Afin de contribuer au respect de l'environnement, merci de n'imprimer ce mail qu'en cas de nécessité</span></span><span style="color: rgb(51, 51, 51); font-family: times new roman,new york,times,serif; font-weight: bold;" data-mce-style="color: #333333; font-family: times new roman,new york,times,serif; font-weight: bold;"><br></span></div></div><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>De: </b>"Benoit GEORGELIN - Association Web4all" <benoit.georgelin@web4all.fr><br><b>À: </b>"gustavo panizzo (gfa)" <gfa@zumbi.com.ar><br><b>Cc: </b>"lxc-users" <lxc-users@lists.linuxcontainers.org><br><b>Envoyé: </b>Vendredi 26 Juin 2015 09:31:09<br><b>Objet: </b>Re: [lxc-users] LXC - Best way to avoid networking changes in a container<br></div><br><div data-marker="__QUOTED_TEXT__">thanks for the link. <br>I will consider this option too. This should be an interesting configuration.<br>I'm surprise there isn't many talks about it . <br><br>Cordialement, <br><br><br>----- Mail original -----<br>De: "gustavo panizzo (gfa)" <gfa@zumbi.com.ar><br>À: "lxc-users" <lxc-users@lists.linuxcontainers.org>, "Benoit GEORGELIN - Association Web4all" <benoit.georgelin@web4all.fr><br>Envoyé: Vendredi 26 Juin 2015 09:23:49<br>Objet: Re: [lxc-users] LXC - Best way to avoid networking changes in a container<br><br>you can configure openvswitch to drop the pkts if the mac address and/or <br>ip does not match. or you can use an SDN controller which will do it for <br>you <br><br>http://openvswitch.org/pipermail/discuss/2011-May/005112.html for an <br>example how to do it manually <br><br><br>On June 26, 2015 11:59:04 AM GMT+08:00, Benoit GEORGELIN - Association Web4all <benoit.georgelin@web4all.fr> wrote: <br><br><br>Hi, <br><br>I'm looking to avoid network changes in an LXC container with root access while the system is up and running. <br><br>Let's say I have two containers running. <br><br>A: 192.168.0.100/24 <br>B: 192.168.0.200/24 <br><br>They are both on the same private network but it can be a public network too. <br>How can I prevent root user from container B to change his IP address and user the IP address of container A ? <br><br>Container network is built on top of Ovs Switch . Maybe there is a way to restrict MAC Address and IP for a specific port ? I did not see any option. <br><br>Thanks for you advises ! <br><br>Cordialement, <br>Benoit G <br><br><br><br><br><br>lxc-users mailing list <br>lxc-users@lists.linuxcontainers.org <br>http://lists.linuxcontainers.org/listinfo/lxc-users <br><br><br><br><br>-- <br>1AE0 322E B8F7 4717 BDEA BF1D 44BB 1BA7 9F6C 6333 <br><br>Sent from mobile. <br><br>_______________________________________________<br>lxc-users mailing list<br>lxc-users@lists.linuxcontainers.org<br>http://lists.linuxcontainers.org/listinfo/lxc-users<br></div></div></body></html>