How does a datacenter protect itself from IP change by the hosted servers?
Jun 15
This question is inspired by the VPS that I rent from OVH. The OS installation was automatic, and the IP already configured. However, as I have root access, I could change the IP to another, possibly conflicting with another host the local network, which would cause them packets loss. I imagine that OVH has some form of protection against this, both to protect other VPS and to be able to sell extra IP addresses. The same question could be asked about physically hosted servers, it's not specifically about VPS.
How do the datacenter administrators ensure that each hosted server can't use another IP address than the one allocated ?
1 answer
Accepted answer · original discussion
Jun 15
Public cloud providers usually use some form of Port Security to protect against this.
This means that only traffic with the allocated IP + MAC address pair(s) will be allowed onto the network.
For virtualized servers, this security is usually applied on the physical host (i.e. the one hosting the virtualized server).
For bare-metal hosting, this security may be applied to the physical switch(es).
For reference, consider OpenStack's anti-spoofing implementation: https://www.packetflow.co.uk/openstack-neutron-port-security-explained/
1 question comment
Use comments to ask for clarification. Post a solution as an answer.
Jun 15
I could change the IP to another, possibly conflicting with another host the local network - Surely they use VLAN's and other mechanisms to isolate one customer from another. So changing the ip address would only impact your services and not the services of another customer.