Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a network of VMs each having a LAN IP address and a public IP address. They each have a 1:1 NAT map for public access via the public IP for HTTP, SSH etc. I'm trying to figure out a way to restrict the LAN IPs from talking to each other, but there are some cases where a group of LAN IPs will need to communicate.

I'm using pfSense as a firewall / router on a 192.168.0.0/24 configuration. It seems like I could assign each VM it's own subnet and add a static route to the firewall for that VM to get back to the firewall for internet access / other fw rules. Is that right?

I assigned 1 VM with: address 192.168.1.2 netmask 255.255.255.254 gateway 192.168.1.1

Then added a static route on the FW's LAN interface using 192.168.1.0/30 as the destination network and 192.168.1.1 as the gateway.

Nothing appears to be working, anyone have any ideas? Please be aware I'm not that familiar with subnets.

Thanks!

share|improve this question
    
as per your example: which host has the ip 192.168.1.1 that you refer to as gateway? –  lepole May 11 '10 at 20:24
    
none, how can I point it at the main FW? static route? Can I just list the main FW as the gateway on the VM? –  bwizzy May 11 '10 at 22:52
    
Is it just a typo or do you really have your firewall on 192.168.0.0/24 and your VMs on 192.168.1.0/30? If this is the case there is no way for your firewall to route because your VMs are not on the same subnet to start... –  Clint Mar 28 '11 at 6:13
add comment

4 Answers

What OS are you running on the VMs? It might be easier to just use internal firewalls on the machines. That way you can pick and choose what addresses each VM responds to.

share|improve this answer
    
All the hosts run linux, and while an iptables solution would work, I'd like to have something that can be managed in 1 place rather than updating / managing iptables rules on 100s of hosts. –  bwizzy May 11 '10 at 22:54
add comment

Mask = 255.255.255.254???? Take a look at this

Network           Net Broadcast     CIDR Mask              UsableHosts 
192.168.1.0       192.168.1.3       30   255.255.255.252   2           
192.168.1.4       192.168.1.7       30   255.255.255.252   2           
192.168.1.8       192.168.1.11      30   255.255.255.252   2           
192.168.1.12      192.168.1.15      30   255.255.255.252   2           

The output if from my Subnet Planner

share|improve this answer
    
Sorry that was a typo, my subnet is 255.255.255.252 as shown in your first example. –  bwizzy May 14 '10 at 13:32
add comment

I don't understand why you do this step:

"Then added a static route on the FW's LAN interface using 192.168.1.0/30 as the destination network and 192.168.1.1 as the gateway."

Create one VLAN per virtual machine or customer. Assign a proper network, /30 or larger. First address is network, second would be the Firewalls IP on that subnet - and the other or the rest until the broadcast are to be used by the VMs.

That's it, all you need is adding rules either for the VLAN interfaces, or if you prefer for the IP's within the VLANs.

share|improve this answer
    
The static route you added is not needed, perhaps not even functional. If FW has address 192.168.1.1 for VLAN 123 - then the FW already know how to route it's other networks there. For every interface with an IP, there is a route. –  3molo Sep 18 '10 at 8:34
add comment

Most firewall rules use masks which work the same as subnet masks, but can be used to target multiple subnets, or blocks of IP addresses within a subnet.

So leave your gateways alone, but group your VM IP addresses together within your subnet so you can write masks that specify those VMs. You can target a single IP address with the mask 255.255.255.255. You can use a CIDR Calculator to help you figure this out, or take a look at the IP allocation diagram in Gary A. Donohue's excellent Network Warrior book.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.