Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can we prevent 200+ virtual machines from seeing each other but can access the Internet and a shared server?

These VMs are in a couple of ESXi machines.

Having a 1-1 subnet for each virtual machine seems wrong.

share|improve this question
Can you just configure them to not look for other computers? Or is there some broadcast announcement stuff going on that you can't disable? – Fake Name Aug 26 '11 at 12:59
Interesting. Are you doing virus research? – Fake Name Aug 27 '11 at 4:56
up vote 2 down vote accepted

The only way I can see to do this is to use one of VMWare's "vShield App" or "vShield App with Data Security" products, it's what they suggest themselves for this type of scenario.

The problem with creating a VLAN or Private VLAN per client/VM is that you'll have to create that on the switch and then either on every vswitch on every host or using distributed switches (as mentioned you need the very spendy Ent+ licence for that). Using the vShield tools you'd be able to use one big VLAN but tie a particular client/VM/VMs together - as I say it's this exact problem that the software was written to deal with.

share|improve this answer

You are probably looking for what is called Private VLANs which allow the hosts to talk out, but not to each other at Layer2.

share|improve this answer
As an addendum: in ESXi, you'll need to be using distributed virtual switches (Ent+ license level) to be able to use PVLANs. – Shane Madden Aug 26 '11 at 5:57
Whats wrong with sticking them all behind NAT? – Silverfire Aug 26 '11 at 6:27
If they're all behind the same NAT, they can see each other. – David Schwartz Aug 26 '11 at 8:28
And if they're all behind different NATs, then you're back to the "1-to-1 subnet" problem. – womble Aug 26 '11 at 9:40

Software firewall rules to deny all traffic except to/from the gateway.

I don't know how to script that to 200 users in Linux (or even what the script would be, I'm assuming something with iptables), but on Windows you would deploy that rule via a group policy.

share|improve this answer
I liked Zypher's idea, too, but this seems like the best solution to me. – Ward Aug 26 '11 at 7:19
Software firewall running inside the VMs isn't possible because those machines are unrestricted (there is a business reason). – LostInComputer Aug 26 '11 at 8:44

It might seem wrong, but it seems to me to be the right solution. In principle, yes, Ethernet-layer filtering (which is, when you get down to it, what you're trying to do with Private VLANs) might get you where you want to be, but it does confuse the living hell out of anything that expects to be able to communicate directly -- say, a VM that happens to be on the same "subnet" as one it (legitimately) wants to talk to (I might want to wget a tarball from a site that happens to be hosted on the other VM).

share|improve this answer
+1 - "seems wrong" does not mean "wrong"... – Moritz Both Sep 6 '11 at 7:04

As Private VLAN is a constructor protocol (Cisco), you need to have specific Cisco switch with the right licence to use private VLAN. An easier solution is to use ebtables as a bridge firewall if you don't already own big switches.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.