<gchristensen> I have a VM running with tap0
<gchristensen> I'd like it to not be able to chat with any devices on my network, only public IPs
<gchristensen> so I tried this, but.. $ sudo ip route add blackhole 10.0.0.0/8 dev tap0
<gchristensen> RTNETLINK answers: Invalid argument
<gchristensen> any suggestions on how to do this?
<gchristensen> hmm maybe iptables
<cransom> iptables in the output table, yeah.
<gchristensen> how about FORWARD table?
<gchristensen> sudo iptables -I FORWARD -i tap0 --dest 192.168.0.0/16 -j DROP is what I'm trying
<cransom> unless you have a really great plan and real need for it, doing security in the routing table is probably a bad idea.
<gchristensen> sure, that seems reasonable
<gchristensen> what should I look at instead?
<cransom> ah, yeah. that would do as well.
<gchristensen> oh
<gchristensen> you're saying use iptables, not routes
<cransom> i was thinking you would use the output since that's where i thought you were modifying the table
<cransom> yes, use the firewall.
<gchristensen> coo/
<gchristensen> cool
<cransom> didn't you already have a setup like this to segregate the mac builders somewhere?
<gchristensen> I do that with vlans
<gchristensen> I'm reconsidering how builders build, and this is part of it
<cransom> tap, vlan, same thing.
<gchristensen> ah
<gchristensen> well I don't restrict the builders at all beyond being on their own vlan
<gchristensen> :)
<cransom> all made in taiwan/all layer3 interfaces
<gchristensen> anyway, the next round of builders will be much more locked down / assumed to be malicious
<gchristensen> (in fact, I'd love to have people try to break them once I have something to try)
<cransom> unless you were doing layer2 only, then you get into ebtables world.
<gchristensen> I wouldn't blow too hard on the security measures of the builders.
<gchristensen> next round, yes please
<gchristensen> thank you, cransom :) good night!
pie___ has joined #nixos-on-your-router
pie__ has quit [Ping timeout: 246 seconds]
pie__ has joined #nixos-on-your-router
pie___ has quit [Read error: Connection reset by peer]
mmlb977450 has quit [Ping timeout: 250 seconds]
mmlb977450 has joined #nixos-on-your-router
andi- has quit [Ping timeout: 258 seconds]
andi- has joined #nixos-on-your-router
andi- has quit [Excess Flood]
andi- has joined #nixos-on-your-router
andi- has quit [Ping timeout: 255 seconds]
andi- has joined #nixos-on-your-router
Guanin has joined #nixos-on-your-router
Guanin has quit [Quit: Leaving]
Guanin_ has joined #nixos-on-your-router
mmlb9774508 has joined #nixos-on-your-router
mmlb977450 has quit [Ping timeout: 246 seconds]
mmlb9774508 has quit [Ping timeout: 250 seconds]
mmlb9774508 has joined #nixos-on-your-router
Guanin_ has quit [Quit: Leaving]