<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
Hi there,<br><br>I want/need to enforce instances to use the IPs allocated by OpenNebula.<br>I do have them configured on boot, but nothing currently prevents my users to change them.<br>This can lead to problems as they can DoS other user instances, or even my router, proxy or infrastructure services.<br>I currently use ebtables, but it only prevents mac spoof (by the way, what's the use case for that?). Iptables, as far as I can see, will only set rules for Layer 7.<br>I previously tested CloudStack, and they used iptables to enforce the IP. Also, as far as I know, libvirt now supports ip antispoof.<br>I though about adding the iptables rules to ebtables, but then I they would be overriden by OpenNebula firewall. Also, I'm unsure how it would behave when machines are live migrated.<br>My question is if there is a way, out of the box, to prevent spoof. If not, maybe somebody can give me some guidance on what files or hooks to change.<br><br>Thanks.<br> </div></body>
</html>