Migration on an untrusted subnet is not safe in current versions of Xen.
It may be possible to perform migrations through a secure tunnel via an
VPN or SSH. The only safe option in the absence of a secure tunnel is to
disable migration completely. The easiest way to do this is with
iptables:
# this command disables all access to the Xen relocation port
iptables -A INPUT -p tcp -{}-destination-port 8002 -j REJECT
