  Re: [libvirt] [PATCH] network: don't forward DNS requests from
isolated networks  On 07/29/2011 02:35 PM, Laine Stump wrote:
This is in response to:   which points out that a guest on an
"isolated" network could potentially exploit the DNS forwarding
provided by dnsmasq to create a communication channel to the
outside.  This patch eliminates that possibility by adding the "
--no-resolv" argument to the dnsmasq commandline, which tells
dnsmasq to not forward on any requests that it can't resolv
itself (by looking at its   own static hosts files and runtime
lsit of dhcp clients), but to   instead return a failure for
those requests.  This shouldn't cause any undesirable change
from current behavior, even in the case where a guest is
currently configured with multiple interfaces, one of them being
connected to an isolated network, and another to a network that
does have connectivity to the outside. If the isolated network's
DNS server is queried for a name it doesn't know, it will return
"Refused" rather than "