Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Out of curiosity, would it be pointless/wasteful/silly to put a firewall as a VM guest (regardless of VM host - ESX, Xen, Hyper-V, etc. etc.) and redirect all traffic from other VM guests through the firewall VM guest?

I'm not sure if other people/organizations practice this or not. I know resources might be constrained (CPU, RAM, Disk/Net I/O) pending whatever traffic may pass, but are there any other scenarios or situations where placing a firewall as a guest VM and having the other guest VMs route to it rather is better or comparable to an external box from the host VM?

In terms of performance, I realize that being a guest VM resource usage will affect other guests but aside from that, am I missing anything? Security, best practices, common sense?

Any thoughts, comments or criticisms are welcome.

share|improve this question
up vote 5 down vote accepted

This is a very common configuration often called "DMZ in a box". Here's a VMware whitepaper that discusses the various levels of collapsing DMZs using virtual infrastructure.

VMware's vSphere builds on some of these ideas and extends them with a product called vShield Zones

share|improve this answer
I wasn't aware that this was a feature within vSphere. Very cool! Thanks for the links. – osij2is Feb 2 '10 at 22:44
Worth additional emphasis: For this to provide ANY security your VM traffic net and your VMWare Management net need to be physically separate. – voretaq7 Feb 2 '10 at 22:51
@voretaq7 - absolutely. – Helvick Feb 2 '10 at 23:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.