Stopping a VM from connecting out (QEMU-KVM)

[Lunawolfy]

Hey all,

I am looking to create a forensically sane environment for a VM, in which the host and guest systems can communicate with each other, however the VM cannot communicate outwith the host machine.

The host machine requires connectivity so pulling the cable is out

Does anyone know of a config/function withing KVM or libvirtd which can do this, I am aware of isolate mode however that will stop the host and guest communicating.

I suppose I could always add a drop string to the OUT chain in iptables, however I was looking for a more robust solution.

Thanks!

 

[Lunawolfy]

Any tutorial on how to do this? New to all this vis-a-vis project.

 

[Lunawolfy]

Not using VMware tho. Using KVM.

Ideally connectivity would go like this:

Internet <<>> Local Network <<>> Host Machine !<<>> Guest VM

So the host can interact with the VM, however the VM cannot escape the scope of the host.

I've been looking at namespaces, however I'm not too sure how to implement them.