Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently installing a server that consists of a Virtualization Host (kvm on ubuntu) and 7 VM's, some running MySQL and LDAP, others running different webservers and webapplications. The VMs running the databases would only be queried by the other VMs on the same physical server. The webserver VM's will run something like 10-20 websites and webapps. The server will be placed in a datacenter, directly connected to the internet.

My idea was to use NAT networking between Host and the VM's (forming a LAN internally) and to assign to the HostOS the public IP address. The HostOS will run the firewall (with iptables) and distribute the network traffic to the VMs. VMs would be shielded off initially completely from the outside and so there would be no need in this scheme to have a full-featured firewall on either of the VMs. Also, I would just need 1 public IP address. I have to pay extra for additional IP addresses and I can't have no more than 5.

I figured I could use a reverse proxy on the HostOS to distribute traffic among the VMs based on the requested hostnames.

My question is twofold:

  • Is this a sound way to setup the hostOS and the VMs? Or will a reverse proxy slow down the server too much? Should I instead just use bridge networking (recommended by most sources), accept that all my VMs are directly exposed to the outside and take measures on them accordingly?
  • What would be a good reverse proxy to run on the hostOS. I hear good stories about HAproxy. I've setup mod_proxy before (in a completely different scenario though), but I hear most people prefer HAproxy. Or do I need some ultralight weight reverse proxy that takes the least footprint as not to slow down the hostOS too much?
share|improve this question

I'm using exactly this kind of architecture with Proxmox. Bridge networking wan't an option, since I haven't a sufficient number of public IP for the virtual machines. I'm using nginx as proxy virtual machines, you can configure it directly on the Host, but using a virtual machine isn't a bad idea too (try to keep as simple as possibile the Host configuration).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.