Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to protect individual VMs on a vSphere/ESXi host with firewalls rules using a solution that works directely on the hypervisor. By default vSPhere does not allow that, right? It has to support a clustered setup of course. What are my options?

What is not an option for me is: - Running a firewall as a VM and bridging all the VMs behind that. - Using the Windows build-in firewall since they want admin to the OS and hence can just disable the Windows Firewall.

A scenario would be one VM where you give a user access to. But from that machine he should be totaly isolated from the rest of the network. So he should not be allowed to access any other machine. Even not the ones on his own subnet

share|improve this question

For VMware vSphere, the right firewalling solution is the VMware vCloud Networking and Security (formerly vShield) module available with the paid product (Essential Plus tier and above $$$).

This would allow granular controls and network monitoring of VM's, including those on the same subnet.

It works by inserting a filter on the configured interfaces of your VM in the .vmx file. Traffic is filtered through a set of vShield virtual machines (a management VM and a firewall per host): = "vshield-dvfilter-module"
ethernet0.filter0.param1 = "uuid=50048229-580b-7327-832e-1390c8c98044.000"
ethernet0.filter0.onFailure = "failClosed"

If the vShield virtual machines fail, VM traffic on the configured VM's will halt by default.

share|improve this answer

The hypervisor does not perform firewalling or NAT on its VMs. It's intended to function as if it's not there from a network standpoint.

With that said, if you want logical network separation between VMs you'll have to do it using a more conventional network method. This will come down to host-based firewalls, VLANs, tight access controls, or even more complex methods like RADIUS authentication.

share|improve this answer
There are hypervisor-add-on products now that do firewalling and other network security functions. – mfinni Feb 14 '13 at 15:04

There are also 3rd-party hypervisor-based firewalls. I had decent experience with Juniper VGW :

share|improve this answer
Is it a lot of $$$??? – ewwhite Feb 14 '13 at 15:26
I honestly couldn't tell you. It was implemented as part of a high-visibility, well-resourced PCI project, so I'm sure that it wasn't cheap. – mfinni Feb 14 '13 at 16:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.