I have a dedicated server running Debian Buster. I am connected through a single network interface and I orderd an extra IP from the server provider.

I would like to setup a KVM guest which will be directly using the extra IP. I already googled the issue and found some possible using a bridge. However I would like to make sure that the traffic to the seconday ip address (guest) never goes through the host to avoid leaking the information that both host and guest are running on the same machine.

My guess would be to use firewall rules but I'm not an expert in iptables and would not like to misconfigure it for security reasons.

What is the best strategy to route the traffic directly to the guest and make sure it never reaches the host system ?

Is it possible to do route the traffic at the ethernet level in the stack ?

The host is using firewalld and systemd-networkd unit files for network configuration. The host IP and extra IP are both on the same subnet. The guest will be a Debian KVM machine.

EDIT: Regarding the traffic route, I mean it's OK if it goes through the host firewall (kernel network stack) then ONLY routed to the guest without leaving a clue it went through the firewall. This means no services in the host would be available through the second IP.

  • I made an edit to clarify my needs. Can you confirm it's yet impossible ? – Chakib Jul 26 at 15:25
  • I don’t know, so I withdraw my comment. – Scott Jul 26 at 15:27

A software bridge on your host gives you exactly this, just don't configure anything but the host IP on the bridge. (Configure the extra IP on the guest interface corresponding to the internal bridge port, invisible to the host.) The bridge is an Ethernet level (L2) device, does not appear as a separate hop in the IP level (L3) route.

  • Thanks for the answer. That's what I wanted to be assured about. – Chakib Aug 4 at 8:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.