Hi,

Il 17/07/2021 21:07, Frédéric Pierret ha scritto:

I've not an alternative idea yet but, I'm wondering if leaking appvm names in "higher" untrusted appvms is reasonable, especially for confidentiality. Maybe simply use the destination appvm ip, here in your example that would be personal ip. dom0/GuiVM has access to the info so getting appvm name from ip should be simple.

I understand. It is useful for now for me for debugging and following the rules flow, but I will think for something better that solve this problem.

Here too, I'm not sure adding such info is a good idea for security. What exactly do you have in mind for the last needs additional rules?

Well, the last hop, such as sys-net in my last example, needs to know that it is the last hop. It has to set the 'srchost' and allow incoming connections only from the allowed ranges, while middle hops just needs to allow connections from the previous and the next hop. I have yet to look into nft enough, but I guess something else might change when dealing with the physical/external interface too. As for the first hop I have no requirements in mind so maybe that can be avoided.

One more thing, maybe between internal hops it makes sense to randomize
the forwarded ports? This way we can prevent forwarding from different
appvm which shares the same network path or even just one hop from
overlapping, at least internally. Does it makes sense for you?

Thanks, I will think about that too.

Cheers
Giulio