Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running some guests on a KVM dedicated server, and I would like to use the host as a firewall, to control all accesses down from the hypervisor, using forwarding rules.

It is a good idea or is better to run iptables on every guest machine? Do you know any similar case of use, or any guide?

share|improve this question

In our company we setup the firewall on the KVM host so we configure it only once, not in each guest. You can read about our shorewall setup here:

but it's only in Catalan, sorry

share|improve this answer

It depends. If you control the host and all the guests it's simpler to configure a firewall on the host and leave the guests open. If you don't control the host, or you need the guests to be more independent (e.g. managed by different people) then configuring firewalls in all the guests is better (you still want a firewall on the host to block access to itself). If you're really security paranoid you might want to configure firewalls on both the host and the guests.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.