Bonjour

J'ai un problème d'isolation entre des VM connectés à un OpenVSwitch et utilisant des VLAN. Les vlan ne jouent pas leur rôle de cloisement. Je copie ci-dessous le post stackoverflow que j'ai effectué, resté sans réponse à ce jour.

I have 3 VM (qemu with tap interface), 2 on vlan 10 and 1 on vlan 66 on the same lab1 OpenVSwitch. The first VM is connected via a tap interface on port lab1vm1. The second has 2 network interfaces connected on port lab1dhcp and lab1dhcpmaster and the third VM on port dhcpmaster.

-------------   -----------------------  --------------
| VM 1      |   |        VM2          |  |   VM3      |
|10.10.10.3 |   |10.8.6.1  10.10.10.13|  | 10.10.10.2 |
-------------   -----------------------  --------------
   |                |           |             |
   |                |           |             |
------------------------------------------------------------------
|lab1vm1          lab1dhcp  lab1dhcpadm   dhcpmaster     OVS lab1|
|tag 10           tag 10     tag 66         tag 66               |
------------------------------------------------------------------

The OpenVSwitch is configured as follow :

    Bridge "lab1"
        Port "lab1vm1"
            tag: 10
            Interface "lab1vm1"
        Port "lab1"
            tag: 10
            Interface "lab1"
                type: internal
        Port "lab1dhcp"
            tag: 10
            Interface "lab1dhcp"
        Port "lab1dhcpadm"
            tag: 66
            Interface "lab1dhcpadm"
        Port dhcpmaster
            tag: 66
            Interface dhcpmaster
    ovs_version: "2.9.2"

The problem: VM1 can ping VM3!

• If I power off VM2 or shutdown lab1dhcp or lab1dhcpadm interface, the ping doesn't work.
• If I shutdown the two network interfaces of VM2, ping works !

Why VM2 relay ICMP packet from VM1 to VM3 ? The broadcast send by VM1 reach also VM3 ! for example, if I ask an address from dhcp client on VM1, VM3 receive the dhcp discover.

Merci pour votre aide.

Florent