guest MAC-address isolation

Hello.

I am having network issues that I suspect are related to kvm's user mode networking; in particular:

I have a server setup with virtualized kvm clients started with "user mode" networking and RDP port redirection as follows:

 7719 ?        Sl   454:05  \_ kvm -m 2048 -redir tcp:3394::3389 ...
 7731 ?        Sl    97:58  \_ kvm -m 2048 -redir tcp:3393::3389 ...
 7768 ?        Sl   109:23  \_ kvm -m 2048 -redir tcp:3392::3389 ...
 7801 ?        Sl    43:46  \_ kvm -m 2048 -redir tcp:3391::3389 ...
 7823 ?        Sl    16:19  \_ kvm -m 2048 -redir tcp:3398::3389 ...
 7834 ?        Sl    59:38  \_ kvm -m 2048 -redir tcp:3395::3389 ...

which are being accessed by linux rdesktop clients.

Although server and clients are on the same LAN, RDP-traffic is only updated in correlation to user input, leaving me looking for a way to circumvent this, so that the users don't have to frantically thrash their mouse to and fro, to get data on their usb-sticks or watch YouTube. ;-)

All kvm's are using (and must use) the same MAC-address; this shouldn't be a problem with "-net user", right?

Aside from my specific setup, what I'm really looking for is the best way to achieve "guest MAC-address isolation".

Is slirpvde worth trying, or maybe tcp-bridge (I suspect that the performance is not acceptable)?

Any ideas on whether there is a way to achieve "guest MAC address isolation" with ebtables? I can get "MAC NAT" (sort of) working with:

ebtables -t nat -A PREROUTING -d 00:11:11:11:11:11 -j dnat --to-dest 00:01:23:45:67:89 --dnat-target ACCEPT ebtables -t nat -A POSTROUTING -s 00:01:23:45:67:89 -j snat --to-src 00:11:11:11:11:11 --snat-arp --snat-target ACCEPT

but I have no idea on how I might be able to achieve "guest MAC address isolation" with multiple guests needing the same MAC.

My current non "user mode" networking setup looks as such (a little debian specific):

/etc/network/interfaces:
auto lo

iface lo inet loopback

auto br0

iface br0 inet static

bridge_ports eth0

bridge_maxwait 0

address 192.168.2.200

netmask 255.255.255.0

gateway 192.168.2.1

pre-up modprobe ip_conntrack_tftp

pre-up modprobe ip_conntrack_ftp

pre-up modprobe ip_nat_tftp

pre-up modprobe ip_nat_ftp

auto natbr0

iface natbr0 inet static

        bridge_ports dummy

        bridge_maxwait 0

        address 192.168.99.1

        netmask 255.255.255.0

        up /usr/sbin/dnsmasq --interface=natbr0  --except-interface=lo --bind-interfaces --user=nobody \

         --dhcp-range=natbr0,192.168.99.50,192.168.99.100,255.255.255.0,192.168.99.255,72h \

         --domain=example.net --pid-file=/var/run/natbr0_dnsmasq.pid --conf-file

        post-up echo 1 > /proc/sys/net/ipv4/ip_forward

        post-up iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE

        post-up iptables -A FORWARD -s 192.168.99.0/24 -j ACCEPT

        post-up iptables -A FORWARD -d 192.168.99.0/24 -j ACCEPT

/etc/kvm/kvm-ifup-br:
#!/bin/sh

BRIDGE=br0

/sbin/ifconfig $1 0.0.0.0 up

/usr/sbin/brctl addif $BRIDGE $1

/etc/kvm/kvm-ifup-natbr:
#!/bin/sh

BRIDGE=natbr0

/sbin/ifconfig $1 0.0.0.0 up

/usr/sbin/brctl addif $BRIDGE $1

I would be most interested in an (guest agnostic) ebtables solution. Any help or insight is much appreciated.

Thank you in advance,
best regards,

Robert

PS. Please BCC me, as I am not on the list.