2 ms·
It can be done, but... if you have a router with VLAN support (Mikrotik, Ubiquiti, OpenWrt, many others), use VLANs. Isolate your VMs in their own subnet and c
by vetinari 5y ago
It can be done, but...
if you have a router with VLAN support (Mikrotik, Ubiquiti, OpenWrt, many others), use VLANs. Isolate your VMs in their own subnet and configure your router what is allowed or not allowed for hosts in that subnet.
- qqtac 5y agoYep, it's not convenient to manage though.
- vetinari 5y agoDepends, what you consider convenient. If you happen to have homelab cluster and you want your rules to survive a VM migration from one host to another, it is not convenient to have them defined per-node. Alternatively, you can have a look how Proxmox does it. Proxmox uses qemu for VMs, iptables for firewall and their own cluster solution (corosync) to distribute the config (if you happen to have cluster) to all nodes. They are capable of isolating VMs connected to the same bridge.
- qqtac 5y ago> Depends, what you consider convenient. If you happen to have homelab cluster and you want your rules to survive a VM migration from one host to another, it is not convenient to have them defined per-node. Yep true. I don't have a homelab, only a signle computer. I run random applications and games from time to time, so to me convenience is something I can quickly set up and discard.