Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

My goal is to establish a perimeter around a VirtualBox hosted VM. Total network control. I want to monitor, log, filter, prioritize, block, drop, or otherwise inspect or manipulate every outgoing and incoming network packet, establishing rules by IP address, domain name, port. Packets are processed according to rules. Unless there is a rule to drop or pass the packet, the default rule is to hold packets in a queue for the operator to establish a rule, ideally using a GUI tool that pops up when a new packet awaits "moderation" and facilitating the creation of the rules.

I would prefer the firewall appliance to run in the host system, but it can also run in another VM if necessary.

My host system is Kubuntu. I will consider any other Linux or BSD host. I see no reason to consider Windows or OSX host, but am open to be persuaded otherwise.

I would prefer the firewall to be Free / Open Source, but I will consider proprietary solutions if they have comparative advantages.

What are the best tools to accomplish this? Any sample configuration out there?

share|improve this question
3  
The faq specifically states that SF isn't the place for product or service recommendations – t1nt1n Dec 25 '11 at 18:17

closed as not constructive by MDMarra, Bart De Vos, John Gardeniers, Iain♦, Rilindo Dec 25 '11 at 23:30

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

2 Answers

up vote 1 down vote

I would recommend that you implement the firewall at the host level. In terms of network design, this will be more secure since you are protecting both the host and the VM.

As a first step I would recommend that you utilize the default firewall included with Kubuntu, namely 'ufw'. There is a GUI called 'gufw' available for it here

Regarding your requirements for firewall rules and packet handling, I am not sure that 'ufw' has an interface to the kernel packet queuing functionality, but as a starting point it is as secure as any other linux firewall since it uses the kernel modules, netfilter and iptables.

At the other end of the features scale is Shorewall which is an 'industrial strength' firewalling and routing application which provides a command line front-end to netfilter and iptables. Shorewall can definitely do what you require, however, beware its steep learning curve - which is thankfully facilitated by excellent documentation and examples.

share|improve this answer
up vote 1 down vote

It sounds to me like you're over-thinking this. Just route all the guest's network traffic through the host and monitor as you will.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.