IPMI Router

Yandex Builds Secure KVM Access for BareMetal Servers with IPMI Proxy and Network Isolation

Yandex Cloud engineers developed a layered architecture to grant external users safe KVM access to dedicated BareMetal servers while protecting the shared IPMI network. The solution combines IPMI Proxy containers that normalize vendor-specific protocols into VNC, IPMI Router instances running jool for IPv6-to-IPv4 translation, and strict L2/L3 controls using 802.1X, eBPF, and switch ACLs. DHCP is delivered statelessly by deriving IPv4 addresses from MAC addresses to simplify failover with VRRP. Client-side risks from legacy Java and weak hashes are contained by running minimal containers and mounting ISO images from S3 as external volumes. Continuous permission checks every ten seconds ensure long-lived sessions do not become persistent attack paths. The resulting design unifies access across hardware platforms inside the Yandex Cloud console without exposing BMCs to lateral movement.