up vote 3 down vote favorite
2
share [g+] share [fb]

We have an ESXi host running which has 5 NICs in total. Until now it hosts only VMs for our internal network. We also have a firewall so that users on the net can browse the internet (proxy). The firewall is an UTM appliance and also has a DMZ port. Now I thought we could also put a webserver (or similar) on one VM and make it accessible on the internet. This virtual server would get one dedicated NIC on the ESXi which is connected to the DMZ port of the firewall. Would this be a good idea or are there any (security related) considerations against this scenario? Since its a seperate NIC it would get its own vSwitch on the vCenter and would have no physical connection to the internal net. But the vCenter manages the whole host and has access to all NICs etc. so I'm not sure if this is the best solution.

link|improve this question
100% accept rate
feedback

2 Answers

up vote 6 down vote accepted

It's not the best solution, of course - ideally you would have a separate VM host for DMZ guests. If you do choose to go this way though, some points you should take into account:

  • The obvious one first: someone can use an exploit to escape the VM jail and so compromise your LAN hosts from the DMZ. So you should really keep up with patches both on DMZ guests and host, and then hope for the best.

  • Mistakes in the configuration have serious consequences. Think, for example, of the possibility you or some else assigns NICs both on the DMZ and the LAN to some host. Now your DMZ and your LAN are the same thing. Of course you can prevent this by enforcing procedures and just being competent, but you see how you could say you end up with a more fragile environment.

That said, it's still better than not having a DMZ at all so it can be a good stop-gap solution if you can't use a separate host right now. Just keep in mind that it's not as safe as having your DMZ guests on a separate host and real network.

link|improve this answer
Your second point is a bit moot considering someone could just as easily misconfigure a physical DMZ vs. a virtualized one. – gravyface May 23 '11 at 13:58
1  
That's true of course, but I am of the opinion that adding a real NIC (if needed) and connecting a real cable to a real switch takes a little more effort and thought than just setting the wrong configuration in a control panel. I could be wrong though, if more people chime in against that comment I will remove it. – Eduardo Ivanec May 23 '11 at 14:02
Are there working exploits so that an attacker could escape the VM and compromise the entire host and the network behind it? I have never heard of such a thing but I am not a security expert... – duenni May 23 '11 at 14:05
1  
Search for "vmware cloudburst exploit". It's from 2009 though. There was also another high profile one semi-recently but it involved shared folders, which you're not likely to use in a serious environment. – Eduardo Ivanec May 23 '11 at 14:10
There have been a few over the years for various vmware products (vmworkstation had one or two), nothing recent that I know of. – gravyface May 23 '11 at 14:12
show 2 more comments
feedback
up vote 2 down vote

There is nothing wrong with that approach.

I would typically use VLAN trunking to carry a DMZ over the existing links, but if you want it absolutely and completely separated then yes use another link and assign that NIC into a separate vSwitch. This should keep things nice and segmented for you.

link|improve this answer
Yes, the idea was to keep the DMZ on an isolated subnet which can't be reached from the internal net. There is no further switching, the DMZ port of the firewall would be connected directly to the ESXi. So I don't see the effort of VLANs here? – duenni May 23 '11 at 14:37
In most of my builds, for flexibility purposes, we put the majority of the NICs into a single vSwitch each configured as a VLAN trunk and simply break off the vmkernel or vmnetwork ports by VLAN tag. There's no reason you couldn't carry a DMZ over this as well. Depending on load/scale we break off dedicated NICs for iSCSI or vMotion, etc. The separate NIC and separate vSwitch for DMZ is more than adequate to separate the traffic. – SpacemanSpiff May 23 '11 at 14:52
@duenni: depending on the host, number of NICs, how many networks you've setup already, etc. trunking may be the only practical option. – gravyface May 23 '11 at 14:53
Ah, now I see what you meant. Thanks for your input. – duenni May 23 '11 at 17:19
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.