Is it necessary to enforce a NetworkPolicy e g by Namespace rancher-users #harvester

Title

refined-analyst-8898

03/24/2023, 2:55 PM

Is it necessary to enforce a NetworkPolicy, e.g., by Namespace, in order to isolate a Harvester VM network's layer 2? I'm trying to understand and explain why a DHCP server on a VM network of type

L2VlanNetwork

is answering lease requests originating from the attached LAN of the Harvester host's metal NIC. The VM network uses the default mgmt cluster network.

I have a pfSense VM straddling (dual-homed) on two VM networks: an

Untagged

VM network on the WAN side, and the

L2VlanNetwork

on the LAN side of pfSense. The DHCP server is configured on the LAN interface, and is answering requests from the Harvester host's external network that is bridged with cluster network "mgmt". pfSense firewall allows only TCP from WAN to LAN, but I wouldn't expect it to forward layer 2 broadcast frames to LAN side in any case. Most likely I am missing some understanding of Harvester networking! These have helped, but I'm still missing something basic. refs: 1. https://docs.harvesterhci.io/v1.1/networking/harvester-network 2. https://docs.harvesterhci.io/v1.1/networking/deep-dive

I have to wonder if the NIC "model" might be a factor. I wasn't able to use the default

virtio

because the device was undetected in BSD. It was detected with

rtl8139

and

e1000

, so I stuck with one of those.

I've rephrased my question in the forum: https://forums.rancher.com/t/why-does-cluster-network-layer-2-leak-to-l2vlannetwork/40358

2 Views

#harvester Join Slack