Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are having a site wide networking problem that seems to be related to running a large number of VMs under Hyper-V.

We have some tests that start up ~40 VMs (Windows 7 and Server 2008 machines) When all the machines are online the main network becomes unusable. Wireshark captures indicate a huge number of netbios broadcasts.

As soon as the VMs are shutdown the network becomes useable again.

I was thinking I should be able to better isolate the VMs from the main network. Currently they are configured to use a "External" connection and are bound to one of the adapters on the Hyper-V host. This puts them directly on our main network.

My idea was to create a Server 2008 VM with two network adapters, one "External" and one "Private". I would bridge the adapters and put all the test machines on the "Private" network. This seems to have worked and I have the traffic moving through my 2008 bridge server.

Now I would like to create a firewall to restrict certain ports/protocols from being forwarded from the "Private" network to the "External" network. I am not having any luck with this and would appreciate any help. Subnetting the "Private" network is problematic since some of the PCs that the test machines must communicate with are on the main network.

I realize that we must have some other underlying issues with the network, but I wanted to start with the VMs since they precipitate the problem.

Thank you.

share|improve this question

I use M0n0wall for this, which is a small FreeBSD-based server that has a nice-enough front end. Of course, I run a ESXi shop, not a Hyper-V one, but the Generic-PC image should work well enough, if they don't supply a VHD.

(This would be in place instead of the Win2008 machine)

share|improve this answer
I was about to add an answer similar to this recommending the sister product pfSense - What you are really asking for is a routing platform not just a firewall. – Goyuix Aug 17 '12 at 17:48
Thanks for the tips. It looks like both M0n0wall and pfSense would work for what I would like to do. Unfortunately getting them running as a Hyper-V guest appears problematic. The Linux Integration services provided by Microsoft currently supports CentOS and Red Hat. I'm not enough of a Linux expert to jump into a unsupported configuration. I think I am going to have to install RRAS on my 2008 bridge PC along with DHCP and subnet the "Private" network out. (Maybe NAT or use a static route to join the networks?) – Reinyn Bedlington Aug 17 '12 at 17:55
Actually, maybe the easiest solution would be to install pfSense on a physical machine between the Hyper-V server and the network switch... This would also have the best performance as I have already seen 20-70ms lag forwarding through a VM. – Reinyn Bedlington Aug 17 '12 at 18:17
If you're willing to go that far, maybe you can run your vSwitch (I'm talking VMware again!) with dot1q VLAN tagging and have your real firewall take care of traffic between the virtual stack and the rest of your network? – jimbobmcgee Aug 21 '12 at 18:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.