I have a VM running on my Unraid host and also some dockers. I need to block the VM accessing specific dockers, the Unraid shares and the Unraid server WEB-GUI. I could not do it with my router (firewall). I guess the VM can access the dockers directly without going through the router.

 

Are there some iptables configuration or some other means to achieve this? Thank you!

 

Currently there is no optiions within vms. You could look to put vm on a diferent vlan?

48 minutes ago, SimonF said:

Currently there is no optiions within vms. You could look to put vm on a diferent vlan?

 

Thank you for a very fast response!

 

Having the vm in a separate vlan would be ideal but I couldn't do it using my router. That is, it tags the vlan ID based on the network switch port where the device is connected. And as the VM is physically connected to the same port as my Unraid server, I cannot separate the two. Can I somehow allocate a vlan ID in Unraid for all the VM traffic?

You can create vlans and create bridges for each vlan to bind the vm to. Not sure it would work as you wont have a trunk port. 

 

Other option if you have more than one nic to connect to differnent ports with different vlans on the router.

 

again create different bridge per nic.

Thank you for the VLAN pointer! I created a VLAN (br0.40) for the VM and I was able to block any traffic (in the router) from the VM to the unraid server WEB-UI and shares. However, for some reason the access to dockers* still works even though when I block all the traffic from the VM VLAN to the Unraid server VLAN. 

 

* Traffic to dockers with 'Host' network type are properly blocked.

 

So, re the 'Bridge' network type dockers communicating directly "inside" Unraid without traffic going through the network router? Any ideas how to proceed?

 

 

 

I managed to solve this by creating a separate vlan for the dockers. Now I can block unwanted traffic in my router. Thank you for the help! @SimonF