<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Generally I handle this by using a different eth device (or vlan) for the instance network. Then you make sure that no services on compute are listening on 0.0.0.0<div><br></div><div>If you have only one interface for example, you can run three vlans across it</div><div><br></div><div>eth0:10 -> public network <public ip address> for routing and floating ips and such. Nothing should listen here</div><div>eth0:11 -> management network <192.168.0.0/24 range> Rabbit and mysql run on this network. All services (ssh, etc.) run here</div><div>eth0:12 -> vm network <10.0.0.0/8 range> for vms. Nothing should listen here (except dnsmasq obviously)</div><div><br></div><div>Vish</div><div><br><div><div>On May 31, 2012, at 7:35 PM, William Herry wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><font color="#3333ff"><font><font face="tahoma,sans-serif">We use FlatDHCP network mode, all thing work fine, instance has 10.0.0.x ip and 10.0.0.1 as gateway<br>Our problem is that service(most time compute node) has little restrict from instance, <br>
which instance can see a lot opened port on service, I am thinking if this is a security problem<br><br>restrict service on compute node not listen on 10.0.0.x ip is the way I can thing to solve this, any other ways?<br><br>
Thanks<br clear="all"></font></font></font><br>-- <br><font><br><br><br><span style="font-family:tahoma,sans-serif;color:rgb(102,51,255)">William Herry</span></font><font style="font-family:tahoma,sans-serif;color:rgb(102,51,255)" size="2"><br>
====================</font><br style="font-family:tahoma,sans-serif;color:rgb(102,51,255)"><font style="font-family:tahoma,sans-serif;color:rgb(102,51,255)" size="2"><a href="mailto:WilliamHerryChina@Gmail.com">WilliamHerryChina@Gmail.com</a></font><font><span style="font-family:tahoma,sans-serif;color:rgb(102,51,255)"></span><br>
</font><br>
_______________________________________________<br>Mailing list: <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>Unsubscribe : <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>More help : <a href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a><br></blockquote></div><br></div></body></html>