6

How can we prevent 200+ virtual machines from seeing each other but can access the Internet and a shared server?

These VMs are in a couple of ESXi machines.

Having a 1-1 subnet for each virtual machine seems wrong.

2
  • Can you just configure them to not look for other computers? Or is there some broadcast announcement stuff going on that you can't disable?
    – Fake Name
    Aug 26, 2011 at 12:59
  • Interesting. Are you doing virus research?
    – Fake Name
    Aug 27, 2011 at 4:56

5 Answers 5

2

The only way I can see to do this is to use one of VMWare's "vShield App" or "vShield App with Data Security" products, it's what they suggest themselves for this type of scenario.

The problem with creating a VLAN or Private VLAN per client/VM is that you'll have to create that on the switch and then either on every vswitch on every host or using distributed switches (as mentioned you need the very spendy Ent+ licence for that). Using the vShield tools you'd be able to use one big VLAN but tie a particular client/VM/VMs together - as I say it's this exact problem that the software was written to deal with.

7

You are probably looking for what is called Private VLANs which allow the hosts to talk out, but not to each other at Layer2.

4
  • As an addendum: in ESXi, you'll need to be using distributed virtual switches (Ent+ license level) to be able to use PVLANs. Aug 26, 2011 at 5:57
  • Whats wrong with sticking them all behind NAT?
    – Silverfire
    Aug 26, 2011 at 6:27
  • 3
    If they're all behind the same NAT, they can see each other. Aug 26, 2011 at 8:28
  • 1
    And if they're all behind different NATs, then you're back to the "1-to-1 subnet" problem.
    – womble
    Aug 26, 2011 at 9:40
2

Software firewall rules to deny all traffic except to/from the gateway.

I don't know how to script that to 200 users in Linux (or even what the script would be, I'm assuming something with iptables), but on Windows you would deploy that rule via a group policy.

2
  • I liked Zypher's idea, too, but this seems like the best solution to me. Aug 26, 2011 at 7:19
  • Software firewall running inside the VMs isn't possible because those machines are unrestricted (there is a business reason). Aug 26, 2011 at 8:44
1

It might seem wrong, but it seems to me to be the right solution. In principle, yes, Ethernet-layer filtering (which is, when you get down to it, what you're trying to do with Private VLANs) might get you where you want to be, but it does confuse the living hell out of anything that expects to be able to communicate directly -- say, a VM that happens to be on the same "subnet" as one it (legitimately) wants to talk to (I might want to wget a tarball from a site that happens to be hosted on the other VM).

1
  • +1 - "seems wrong" does not mean "wrong"... Sep 6, 2011 at 7:04
0

As Private VLAN is a constructor protocol (Cisco), you need to have specific Cisco switch with the right licence to use private VLAN. An easier solution is to use ebtables as a bridge firewall if you don't already own big switches. http://ebtables.sourceforge.net/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .