On Thu, Jun 11, 2009 at 5:58 PM, Ross Vandegrift <[email protected]> wrote:
> 2) Many VEs in many communities spread across many hosts. For > example, it might get bad if you had 5 communities across 100 hosts, > with each community having 100 VEs. This would mean each host needs > a full set of 10000 MAC rules for each community - 50000 ebtables > rules. In this case, I'd again prefer a routed design (well, any case > actually...) and if a common "community" LAN was a software > requirement, I'd use multipoint GRE or L2TP. > > But for one node with a bunch of unrelated VEs, this is very little > work to maintain. > In my particular configuration, there are no communities - each VE is an island, and will only be able to communicate with the network gateway (which is non-local, ie. not on the linux bridge itself.) That should lock down layer 2. With OpenVZ, each VE's MAC will have a common SWSoft 00:18:51 prefix. After I get that working, I need to lock down layer 3 with iptables, so the PVLAN functionality can't be bypassed. If you have any configuration examples for ebtables, especially simple ones, I would welcome them :) Thanks, Daniel
_______________________________________________ Bridge mailing list [email protected] https://lists.linux-foundation.org/mailman/listinfo/bridge
