Restricting IP ranges for guests over tap devices

[Mark Raynsford]

Hello!

Let's say I have a machine running a few dozen bhyve guests. Each bhyve
guest gets its own tap device, and all of the tap devices are connected
to a bridge.

Everything works fine. I can write pf rules that control access between
each guest, and between each guest and the world. I can't directly
observe the IP addresses that the guests have assigned to the tap
devices I gave them, but if I know the addresses beforehand, I can for
example write pf rules that say things like:

  block log all
  pass in on tap23 proto tcp \
    from any to $guest_23_ip port ssh modulate state

That then means that even if the guest is compromised and tries to bind
a server to another address, the pf rules won't allow anyone else to
actually connect to it.

The good thing about this is also the bad thing about this; I have to
write specific rules that say "only allow access to this specific IP
via this specific tap device". Over dozens of guests, that can multiply
to hundreds of laboriously maintained rules.

Is there some more general way I can supply a mapping between tap
devices and allowed addresses? Remember that pf can't see the guest
addresses on the host sides of the tap devices, so I can't use the
(device) syntax to expand to "the address of a NIC called 'device'".

I can generate rule sets, but perhaps there's something "better"[0]? The
documentation isn't suggesting much.

[0] Better in the sense that, for example, a table is usually better
    than a massive list of macros. :)

--
Mark Raynsford | https://www.io7m.com

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-virtualization/attachments/20200801/30e67ce5/attachment.sig>