DNS forwarding for guest domains on isolated network

[Laine Stump]

On 11/11/20 3:40 AM, Jörg Kastning wrote:
> Hi @all,
> 
> I'm having trouble to realize my use case and hope somebody could help me.
> 
> # Use case
> 
> For a home lab I want to deploy several guest domains. These domains 
> must not have a direct or NAT connection to the internet or my LAN. They 
> should only be able to reach my LAN and the internet through a proxy.
> 
> # What I've done
> 
> I've created the following virtual switch in isolated mode:
> 
> $ sudo virsh net-dumpxml private1
> <network connections='3'>
>    <name>private1</name>
>    <uuid>THE-UUID</uuid>
>    <bridge name='virbr1' stp='on' delay='0'/>
>    <mac address='DE:AD:BE:EF:FF:FF'/>
>    <domain name='private1'/>
>    <ip address='192.168.100.1' netmask='255.255.255.0'>
>      <dhcp>
>        <range start='192.168.100.128' end='192.168.100.254'/>
>      </dhcp>
>    </ip>
> </network>
> 
> I've setup a guest domain that serves as a proxy and several other guests.
> 
> # My issue
> 
> Nameresolution for *.private1 works fine on this network. But I'm not 
> able to resolve domains from the outside world like github.com.

This behavior is intentional:

   https://gitlab.com/libvirt/libvirt/-/commit/513122ae93

> 
> I understood that libvirt is forwarding dns resolution requests to the 
> hosts nameserver configured in /etc/resolv.conf in case the dnsmasq 
> instance for the virtual network is not able to resolve the name.

Not for isolated networks, because a DNS request could be used to break 
out of an isolated network (by using "IP over DNS")

> 
> My guess, in my setup this don't work, because the virtual switch is in 
> isolated mode, right?

When DNS traffic is forwarded by a DNS server, it is at application 
level, not IP level, so any filtering of forwarded traffic on the switch 
is not involved.

> 
> # My questions
> 
>   * What can I do to achieve my use case described above?
> 
>   * Is it possible to use the isolated mode here or do I have to use a 
> different mode?

"no-resolv" will always be in the dnsmasq config file for an isolated 
network, and there isn't any way to remove it (other than using a 
different kind of network). And since there is not (as far as I know) a 
different dnsmasq option to counteract a "no-resolv" that's already 
there, you can't eliminate the effect of no-resolv by adding something 
to the conf file with <dnsmasq:options>. A few things to try:

1) try adding <forwarder addr='x.x.x.x'/> in the the <dns> section of 
the network, pointing to your normal DNS server. Possibly that directive 
to dnsmasq will make a "side run" around the restriction on forwarding. 
(this can also have "domain='blah'" added, in which case it only 
forwards requests for names within the 'blah' domain ).

    https://libvirt.org/formatnetwork.html#elementsAddress

2) use a <forward mode='route'> network, but also add in nwfilter rules 
that only allow traffic on the local network.

    https://libvirt.org/formatnwfilter.html

3) again, use <forward mode='route'>, but also manually add a rule to 
the host iptables that rejects all traffic from the guest network 
outbound on the host's egress interface.

> It's important that the guest domains could only connect to the internet 
> by using the proxy.


Have you tried putting the guests