Let's assume the following configuration: a router that announces IP subnets and a few Proxmox-based KVM hosts. Each Proxmox-based virtualisation host runs multiple virtual servers managed by customers and each virtual server gets one or multiple IPs assigned.
How can I prevent that (miss-configured or evil) virtual server are announcing IPs which don't belong to their server?
The best idea I could come up with is to use iptables
-firewall rules to block any traffic except incoming one with the correct destination address and outgoing one with the correct source address. That should work (but would also block any broadcast traffic I guess, thought that would be acceptable for that scenario). However, is there any better way to do that (without alterations at the routers)? What is the common practice for this problem?