Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Or will I need to administer each firewall for each guest server OS?

Do I do both? Hardware firewall on host, software firewall on each server OS?

What is the best practice here?

share|improve this question
up vote 0 down vote accepted

Keep in mind that if you have more than one subnet in your network (which is quite usual even for small ones), your ESX(i) host will have a management IP on one of them, but your guest VMs will be spread across them depending on your needs; so, putting a firewall in front of the host's management connection will not defend the guest VMs.

This means your question actually makes sense only if you have a single network where both the host and the guests reside; in this case, it depends on your setup and needs; having a firewall on each machine gives you more flexibility, and having a global firewall in front of all of them gives you two layers of defense.

share|improve this answer
Thanks for the clarity. – ioSamurai May 13 '11 at 14:51

Defense in depth, my friend. It is my policy to protect my hosts and VMs with both a dedicated firewall device (hardware firewall is sort of a misnomer), as well as host firewalls running on each VM (either iptables or Windows Advanced firewall).

share|improve this answer

"Best Practice" is to have both an organizational firewall as well as host-based firewalls.

However, if you configure the hardware firewall correctly in front of the ESXi servers, it should do just fine for external protection without host(guest)-based firewalls. Your vulnerability in that instance will be server-to-server traffic being wide open.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.