1

I'm running some guests on a KVM dedicated server, and I would like to use the host as a firewall, to control all accesses down from the hypervisor, using forwarding rules.

It is a good idea or is better to run iptables on every guest machine? Do you know any similar case of use, or any guide?

2 Answers 2

0

In our company we setup the firewall on the KVM host so we configure it only once, not in each guest. You can read about our shorewall setup here: http://www.ingent.net/ca/2012/03/server-virtualization-kvm-hetzner/

but it's only in Catalan, sorry

0

It depends. If you control the host and all the guests it's simpler to configure a firewall on the host and leave the guests open. If you don't control the host, or you need the guests to be more independent (e.g. managed by different people) then configuring firewalls in all the guests is better (you still want a firewall on the host to block access to itself). If you're really security paranoid you might want to configure firewalls on both the host and the guests.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .