Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a virtualised infrastructure here, with separated networks (some physically, some just by VLAN) for iSCSI traffic, VMware management traffic, production traffic, etc.

The recommendations are of course to not allow access from the LAN to the iSCSI network for example, for obvious security and performance reasons, and same between DMZ/LAN, etc.

The problem I have is that in reality, some services do need access across the networks from time to time:

  • System monitoring server needs to see the ESX hosts and the SAN for SNMP
  • VSphere guest console access needs direct access to the ESX host the VM is running on
  • VMware Converter wants access to the ESX host the VM will be created on
  • The SAN email notification system wants access to our mail server

Rather than wildly opening up the entire network, I'd like to place a firewall spanning these networks, so I can allow just the access required

For example:

  • SAN > SMTP Server for email
  • Management > SAN for monitoring via SNMP
  • Management > ESX for monitoring via SNMP
  • Target Server > ESX for VMConverter

Can someone recommend a free firewall that will allow this kind of thing without too much low-level tinkering of config files?

I've used products such as IPcop before, and it seems to be possible to achieve this using that product if I re-purpose their ideas of "WAN", "WLAN" (the red/green/orange/blue interfaces), but was wondering if there were any other accepted products for this sort of thing.


share|improve this question
up vote 0 down vote accepted

If you have Linux in the mix you can use Shorewall. It is easy to configure and allows easy specification of rules such as you need. It has default configurations for one, two, and three interfaces which make a good starting point. See the Shoreall site.

share|improve this answer
Thanks, I'll check it out. Linux certainly is in the mix, I was almost assuming the solution would be Linux-based. – Cylindric Jun 3 '10 at 14:03

In addition to whats listed above.

Assuming your iSCSI SAN has multiple interfaces and/or a management interface you may want to consider making your iSCSI Data VLAN non routed.

Leave the management interface on a routed VLAN so all your emails and SNMP works then just tag off all your iSCSI interfaces onto a VLAN that has no layer 3.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.