Needing a crash course on PVC, VLANs, Remote Virtual Machines and isolation

[zir_blazer]

Allright, so situation is as follows. I have a home network consisting on the following:

1) An ISP-provided ZTE H108N ADSL Modem/WiFi 4-Port Router, which seems to have a custom Firmware with a wizard assistant, but it also offers an "Advanced Settings" menu which launchs the typical Web setup of the Router with the entire range of options. While it has 4 LAN Ports, one has a "Reserved for VoIP" sticker blocking it (Never researched if I can use it as a regular LAN instead).

2) Two wired computers, that connects using two LAN Ports

3) A Notebook that connects using WiFi

4) Sometimes a Tablet, Smartphone, or one of those WiFi gadgets

5) My computer, which is also wired to a LAN Port. However, my entire setup consist on using Xen as Hypervisor, and have at least one or several VMs. I use an easy to setup bridge, and the Router sees the VMs itself and assign them a local IP.

Typical usage is that besides that everything shares the Internet pipe, sometimes we also have permanent Shared Folders where we put data to be available for other computers.

Now, with all the Remote Desktop trend, I want to get creative about what I can do with Xen, since the infrastructure is all there. Its easy to setup VNC/SPICE access to a VM, and with a SPICE client on one of the other computers of the network, I was able to access my hosted VM.
There are a multitude of reasons why I would want to share access to a VM. Ideas that I had was to install the CPU heavy applications on that VM, and let the other family members do things like renders on my Haswell Xeon while I sleep, which should blow their old Athlon II out of the water.
My latest idea was to play games like, for example, emulators with ROMs, and instead of relying on Kaillera for Internet Multiplayer, which is rather unstable (Drops often, forcing to restart the game), I could grant remote access with an SPICE client, thereby the game would be processed locally and I wouldn't need Kaillera at all. I still need to test if it can be sucessfully used simultaneously by two persons at the same time doing a little button mashing. I don't know how much bandwidth it uses, the lag from the other side, and the image quality and, FPS, but at least from inside the local network it looked rather promising. Still, it seems to be a nice idea for a personal "gaming cloud".

Now, the problem relies on the fact that if I give access to anyone to that VM, he can access everything else on my network from inside it (The Shared Folders, Router config, etc). If anyone from my local network access my shared VM I don't care since all the things visible from the local network are also visible from their computers, but if I'm sharing it with someone through Internet, it is extremely unsafe. So, what I want to do, is checking if there is a way to make that the VM is absolutely isolated from the local network yet route it to have Internet access.
As far that I know, it should be possible, since there are things like PVC and VLAN that are around those lines, using the same physical infrastructure but separating it onto virtual layers. My Router seems to soport PVC and/or VLAN via "Port Mapping", but settings seems to be only for physical LAN Port, or a Software Access Point for WiFi, when what I would want to do is to put a MAC Address onto a separate network, since my computer, including the host (Xen Dom0) and all the VMs uses the same cable.

Any ideas of how I can achieve this? Keep in mind I'm rather dumb when it comes to networking besides the physical implementation. Somewhere else I was suggested to set two separate bridges for Xen, but I still don't see how that would isolate it from the local network since they would still go through the Router, which should be responsible for that isolation.
Also, since my computer has two NICs, at the absolute worst case scenario and desesperation, I could do PCI Passthrough of the other NIC to the VM I'm intending to share, and have another cable from my computer to the Router (Which would require to get the LAN Port for VoIP working as a standard one).

 

[zir_blazer]

*BUMP*

No one? I'm really stuck and would love some ideas about how to share in a safe and isolated way a VM through Internet.

 

[KillerBee]

tldr - i guess

How far along in your goal have you reached in the meantime?

 

[zir_blazer]

I can install a SPICE client on another machine of the local network, then connect to a VM in my computer. They see and can interact with that VM. Actually, I can simultaneously view and interact with it from my computer, too (Not via SPICE, since when I open another SPICE client in this machine, it automatically closes on the other computer and viceversa. But I can if I tell Xen to also make a SDL window for the VM, while allowing SPICE protocol access).
I didn't tried to make the VM available from Internet, but based on my previous experience this should be possible by using Port Forwarding in my Router config. However, once they have access to the VM from the outside, they can also freely wander in my local network, since, after all, the VM is part of it. That is what I do not want. However, I don't know how to properly set up a VLAN or something to isolate it. Otherwise, I would have to disable Shared Folders and everything related to network access in the other computers.

 

[Elixer]

Well, there are many ways you can do this, for example, you could create a bridge, then, create multiple (virtual) NICs, and handle it that way.
Then you can NAT/route the traffic you want.
Any reason why are you using Xen, and not KVM?

 

[zir_blazer]

I'm using Xen since I already have the VGA Passthrough part working for my main gaming VM and have the know-how of near 2 years using it. KVM can do the same (And even better, they even workarounded GeForce passthrough), but would require to learn new usage patterns and I don't need any of the new KVM features.

I googled around and there are just TOO MANY ways to do this, but circunstances are always different. In my case, I suppose that I should isolate the Xen virtual bridge on my computer (The VM host) so the VM sees the Router but can't access the host nor the other VMs with internal network traffic, which is how it should be working currently. However, even if I isolate them there, the Router would still show the other VMs itself since it sees the hostname and MAC Address of both host and VMs (And the other computers too). So I need isolation at two places, the virtual bridge, and the Router.


So far, regarding what my Router can do, it can:

- At Internet Setup, I have WAN Setup, where I can create a PVC specifying VPI, VCI, and 802.1Q VLAN ID (0 disabled, or 1+ for a VLAN number).

- At Port Forwarding, it allows me to add a Rule to specify a IP Address from the internal network where I route specific TCP/UDP Ports to.

- At IP Filtering, I can create Firewall and Rules. Firewall ask for an Interface (A PVC), "In, Out, Both", "Permit, Drop", and "Local, Forward, Both" (This sounds identical to what I read about Linux iptables). After creating a Firewall, I can also add a Rule, which has a ton of options fields, protocols and values, too many to count.

- At Bridge Filtering, I can add a Bridge Filter that may include Protocol (Including 802.1Q) Source MAC Address, Destination MAC Address, vlanID, Frame Direction, WAN Interface (PVC).

- Port Mapping allows me to make a group with a PVC and a physical Port or another PVC.

- Static Routing allows me to input a Destination Network Address, Subnet Mask, and selecting a WAN Interface (Not my custom test PVC).

- Policy Route allows me to bind a WAN (Not my custom PVC) to a LAN Port.

- NAT merely allows me to name an internal IP and external IP.

These seems to be the tools I have at my disposal, and the huge amount of options are making me going nuts trying to figure out how on earth to make use of them.
What I need to figure out is how to isolate the VM all the way from my computer virtual bridge to share the physical NIC, to the Router, where they share the physical WAN. Absolutely needing a "for dummies" guide for this one.
I suppose I should ask this at Xen mailing list since they should know much better how to do these type of networks setups since personal clouds are getting more popular.