Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Security/Procedure feedback request virtualized environment
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
volt150
n00b
n00b


Joined: 15 May 2018
Posts: 1

PostPosted: Sat Jun 02, 2018 4:06 pm    Post subject: Security/Procedure feedback request virtualized environment Reply with quote

Hello,

I have a Gentoo machine I am using as a virtualization host with QEMU/KVM, and virtual network interfaces. I would like your feedback on my process/procedures and any security issues that you might see. This machine will be directly connected to the net and I do not have the knowledge to speak with certainty at this time.

Dell PowerEdge R710 - 4 physical network interfaces eno1 - eno4
Gentoo Profile: default/linux/amd64/17.0 (stable)
Kernel Version: 4.9.95
PfSense is providing NAT, Firewall, DNS, and DHCP.

Here is a network diagram of what exists right now:
https://imgur.com/MTMgXJh

netifrc configuration:
Code:

 
#set the dns_domain_lo variable to the selected domain name
dns_domain_lo="homenetwork"

config_eno1="null"
config_eno2="null"
config_eno3="null"
config_eno4="dhcp"

# Future Reference Notes
## 1) Remember that each tap and bridge interface needs to have a symlink to
## net.lo in /etc/init.d/net.lo, and placed in /etc/init.d/
## 2) Each physical interfaces also needs to have a symlink

# Bridges
## Wan Bridge
### This bridge is primarily used to connect WAN to Pfsense
### Naturally only needs 1 physical and 1 TAP
#### This port is connected to a modem in bridge mode. Which means it still
#### has dhcp enabled. PfSense will send a dhcp request and be given an IP,
#### through this swtich
tuntap_wanbridgetap1="tap"
config_wanbridgetap1="null"
iproute2_wanbridgetap1="group kvm"

bridge_wanbridge="eno1 wanbridgetap1"
config_wanbridge="null"
rc_net_wanbridge_need="net.eno1 net.wanbridgetap1"

bridge_forward_delay_wanbridge=0
bridge_hello_time_wanbridge=1000

## DMZ Switch
### The virtual systems behind this bridge will be accessable from -
### the internet
### Currently this needs 4 taps
tuntap_dmzbridgetap1="tap"
tuntap_dmzbridgetap2="tap"
tuntap_dmzbridgetap3="tap"
tuntap_dmzbridgetap4="tap"
config_dmzbridgetap1="null"
config_dmzbridgetap2="null"
config_dmzbridgetap3="null"
config_dmzbridgetap4="null"
iproute2_dmzbridgetap1="group kvm"
iproute2_dmzbridgetap2="group kvm"
iproute2_dmzbridgetap3="group kvm"
iproute2_dmzbridgetap4="group kvm"

bridge_dmzbridge="dmzbridgetap1 dmzbridgetap2 dmzbridgetap3 dmzbridgetap4"
config_dmzbridge="null"
rc_net_dmzbridge_need="net.dmzbridgetap1 net.dmzbridgetap2 net.dmzbridgetap3 net.dmzbridgetap4"

bridge_forward_delay_dmzbridge=0
bridge_hello_time_dmzbridge=1000

## Local Switch
### Systems behind this switch are not accessible from the internet
### Currently requires 1 physical and 7 taps
tuntap_locbridgetap1="tap"
tuntap_locbridgetap2="tap"
tuntap_locbridgetap3="tap"
tuntap_locbridgetap4="tap"
tuntap_locbridgetap5="tap"
tuntap_locbridgetap6="tap"
tuntap_locbridgetap7="tap"
config_locbridgetap1="null"
config_locbridgetap2="null"
config_locbridgetap3="null"
config_locbridgetap4="null"
config_locbridgetap5="null"
config_locbridgetap6="null"
config_locbridgetap7="null"
iproute2_locbridgetap1="group kvm"
iproute2_locbridgetap2="group kvm"
iproute2_locbridgetap3="group kvm"
iproute2_locbridgetap4="group kvm"
iproute2_locbridgetap5="group kvm"
iproute2_locbridgetap6="group kvm"
iproute2_locbridgetap7="group kvm"

bridge_locbridge="eno2 locbridgetap1 locbridgetap2 locbridgetap3 locbridgetap4 locbridgetap5 locbridgetap6 locbridgetap7"
config_locbridge="null"
rc_net_locbridge_need="net.eno2 net.locbridgetap1 net.locbridgetap2 net.locbridgetap3 net.locbridgetap4 net.locbridgetap5 net.locbridgetap6 net.locbridgetap7"

bridge_forward_delay_locbridge=0
bridge_hello_time_locbridge=1000

## Windows Switch
### This switch is used for windows machines and any supporting systems
### Currently requires 1 physical and 1 tap
tuntap_winbridgetap1="tap"
config_winbridgetap1="null"
iproute2_winbridgetap1="group kvm"

bridge_winbridge="eno3 winbridgetap1"
config_winbridge="null"
rc_net_winbridge_need="net.eno3 net.winbridgetap1"

bridge_forward_delay_winbridge=0
bridge_hello_time_winbridge=1000


[EDIT]
QEMU/KVM is using the e1000 network driver for the guest OS.
[/EDIT]

No other configuration has been done.

My primary concern is keeping the host secure. I think what worries me the most is that the bridges and taps are not physical. I do not know what the they are doing underneath and how/if any implication to the host, where a configuration mistake might cost me in security.

Would you change anything? Add anything?

PfSense rules are not within the scope of this post.

I thank you for your time.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum