Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My goal is to establish a perimeter around a VirtualBox hosted VM. Total network control. I want to monitor, log, filter, prioritize, block, drop, or otherwise inspect or manipulate every outgoing and incoming network packet, establishing rules by IP address, domain name, port. Packets are processed according to rules. Unless there is a rule to drop or pass the packet, the default rule is to hold packets in a queue for the operator to establish a rule, ideally using a GUI tool that pops up when a new packet awaits "moderation" and facilitating the creation of the rules.

I would prefer the firewall appliance to run in the host system, but it can also run in another VM if necessary.

My host system is Kubuntu. I will consider any other Linux or BSD host. I see no reason to consider Windows or OSX host, but am open to be persuaded otherwise.

I would prefer the firewall to be Free / Open Source, but I will consider proprietary solutions if they have comparative advantages.

What are the best tools to accomplish this? Any sample configuration out there?

share|improve this question

closed as not constructive by MDMarra, Bart De Vos, John Gardeniers, Iain, Rilindo Dec 25 '11 at 23:30

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

3  
The faq specifically states that SF isn't the place for product or service recommendations –  t1nt1n Dec 25 '11 at 18:17
add comment

2 Answers

I would recommend that you implement the firewall at the host level. In terms of network design, this will be more secure since you are protecting both the host and the VM.

As a first step I would recommend that you utilize the default firewall included with Kubuntu, namely 'ufw'. There is a GUI called 'gufw' available for it here

Regarding your requirements for firewall rules and packet handling, I am not sure that 'ufw' has an interface to the kernel packet queuing functionality, but as a starting point it is as secure as any other linux firewall since it uses the kernel modules, netfilter and iptables.

At the other end of the features scale is Shorewall which is an 'industrial strength' firewalling and routing application which provides a command line front-end to netfilter and iptables. Shorewall can definitely do what you require, however, beware its steep learning curve - which is thankfully facilitated by excellent documentation and examples.

share|improve this answer
add comment

It sounds to me like you're over-thinking this. Just route all the guest's network traffic through the host and monitor as you will.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.