I have a dedicated Linux (Debian 7.5) root server, with a number of guests set up. The guests are KVM instances, and get network access via bridge-utils (NAT, internal IPs, use the host as a gateway).
E.g. one KVM is my WebServer guest, and it gets accessible via the host IP this way:
iptables -t nat -I PREROUTING -p tcp -d 148.251.Y.Z --dport 80 -j DNAT --to-destination 192.168.100.X:80
I do the same with other services, keeping them self-contained, NATed and isolated.
But one guest is supposed to be a network monitor, and shall perform network traffic inspection (like an IDS). Usually, in a non virtual setup I would use VACLs or SPAN ports to mirror the traffic. Of course, inside this one host, I cannot do this (easily, because I don't want to use complex virtual switching approaches).
- Can I get a port mirror using iptables, and redirect all ingress and egress traffic to one KVM guest? All guests have a dedicated interface, like
- Is it possible to selectively forward traffic, based on the protocol (like a VACL forward rule, which only grabs HTTP)?
- do the guests need a specific interface setup, when I need to keep
vnet1as a management interface (with an IP)?
I would be happy for a point into the right direction:
iptables 1.4.14-3.1 linux 3.2.55 bridge-utils 1.5-6
Thanks a lot :)