Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a network of VMs each having a LAN IP address and a public IP address. They each have a 1:1 NAT map for public access via the public IP for HTTP, SSH etc. I'm trying to figure out a way to restrict the LAN IPs from talking to each other, but there are some cases where a group of LAN IPs will need to communicate.

I'm using pfSense as a firewall / router on a configuration. It seems like I could assign each VM it's own subnet and add a static route to the firewall for that VM to get back to the firewall for internet access / other fw rules. Is that right?

I assigned 1 VM with: address netmask gateway

Then added a static route on the FW's LAN interface using as the destination network and as the gateway.

Nothing appears to be working, anyone have any ideas? Please be aware I'm not that familiar with subnets.


share|improve this question
as per your example: which host has the ip that you refer to as gateway? – lepole May 11 '10 at 20:24
none, how can I point it at the main FW? static route? Can I just list the main FW as the gateway on the VM? – bwizzy May 11 '10 at 22:52
Is it just a typo or do you really have your firewall on and your VMs on If this is the case there is no way for your firewall to route because your VMs are not on the same subnet to start... – Clint Mar 28 '11 at 6:13

What OS are you running on the VMs? It might be easier to just use internal firewalls on the machines. That way you can pick and choose what addresses each VM responds to.

share|improve this answer
All the hosts run linux, and while an iptables solution would work, I'd like to have something that can be managed in 1 place rather than updating / managing iptables rules on 100s of hosts. – bwizzy May 11 '10 at 22:54

Mask = Take a look at this

Network           Net Broadcast     CIDR Mask              UsableHosts       30   2         30   2        30   2        30   2           

The output if from my Subnet Planner

share|improve this answer
Sorry that was a typo, my subnet is as shown in your first example. – bwizzy May 14 '10 at 13:32

I don't understand why you do this step:

"Then added a static route on the FW's LAN interface using as the destination network and as the gateway."

Create one VLAN per virtual machine or customer. Assign a proper network, /30 or larger. First address is network, second would be the Firewalls IP on that subnet - and the other or the rest until the broadcast are to be used by the VMs.

That's it, all you need is adding rules either for the VLAN interfaces, or if you prefer for the IP's within the VLANs.

share|improve this answer
The static route you added is not needed, perhaps not even functional. If FW has address for VLAN 123 - then the FW already know how to route it's other networks there. For every interface with an IP, there is a route. – 3molo Sep 18 '10 at 8:34

Most firewall rules use masks which work the same as subnet masks, but can be used to target multiple subnets, or blocks of IP addresses within a subnet.

So leave your gateways alone, but group your VM IP addresses together within your subnet so you can write masks that specify those VMs. You can target a single IP address with the mask You can use a CIDR Calculator to help you figure this out, or take a look at the IP allocation diagram in Gary A. Donohue's excellent Network Warrior book.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.