I have a dedicated server running Debian Buster. I am connected through a single network interface and I orderd an extra IP from the server provider.
I would like to setup a KVM guest which will be directly using the extra IP. I already googled the issue and found some possible using a bridge. However I would like to make sure that the traffic to the seconday ip address (guest) never goes through the host to avoid leaking the information that both host and guest are running on the same machine.
My guess would be to use firewall rules but I'm not an expert in iptables and would not like to misconfigure it for security reasons.
What is the best strategy to route the traffic directly to the guest and make sure it never reaches the host system ?
Is it possible to do route the traffic at the ethernet level in the stack ?
The host is using firewalld and systemd-networkd unit files for network configuration. The host IP and extra IP are both on the same subnet. The guest will be a Debian KVM machine.
EDIT: Regarding the traffic route, I mean it's OK if it goes through the host firewall (kernel network stack) then ONLY routed to the guest without leaving a clue it went through the firewall. This means no services in the host would be available through the second IP.