Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running an Ubuntu Server 12.10 as a single host connected to a NATed router connected using PPPoE to a optical fiber modem. This server is meant to be accessed from the Internet, but also to be used from the LAN as a SVN, MySQL and what not...

The issue is that the router is not customizable enough to serve, so I was thinking about creating a virtual pfSense firewall using KVM inside of the server itself, removing the need of the router. Is this possible? Can the host ignore and block all traffic coming to itself, but not for the firewall?

I am aware this is not the most desirable environment, I accept suggestions based on budget!

share|improve this question

Yes, you can run a firewall as a virtual machine within this environment.

Before doing so, I'd ideally like to see a couple of NICs dedicated to the firewall VM (SR-IOV is nice, try it!) and additional security such as sVirt running at the hypervisor level to protect VMs from each other.

See also Hardware firewall vs VMware firewall appliance for further discussion.

share|improve this answer
The host has 3 NICs, but why would I need them (the host is the only one behind the firewall)? I just need to protect the hypervisor. My problem is trying to find an example of a similar setup using iptables to deny all traffic except what comes out of the virtual firewall – manutenfruits Nov 15 '12 at 8:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.