Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the process of revamping my network with the use of ESXi. The structure of my network before was as follows:

Public -> Win 2008 R2 Server NIC#1
          ADDS/DNS/DHCP/RRAS NIC#2 -> Physical Switch (LAN)

This setup provided all my network clients with routing and internet... I decided to take my network a bit more seriously and upgrade, and installed ESXi instead of Win 2008 R2 and I wanted to have several Win 2012 clients to compartmentalize the jobs the server was doing before.

I have 2 NICs at my disposal (can buy another one if necessary), but I can't wrap my mind around the networking aspect now.

Win 2008 R2 was doing all the routing before, but if I connect the ESXi host to the new Windows 2012 VM (which handles LAN routing) and that VM goes down, I lose access to the ESXi host. At the same time, I don't want to use a hardware router because I liked the topology of my network before, with all the traffic passing through a Windows Server which functioned as a firewall as well.

How should I approach this problem?

share|improve this question
Get a hardware firewall appliance. An OS, regardless of whether it's a server or not, is NOT a proper router. – Nathan C Jul 30 '13 at 14:03
What's wrong with using Windows for routing, it worked perfectly for my network for over a year. – Theveloper Jul 30 '13 at 14:05
As you've experienced, if it goes down for any reason you lose all network access. Hardware is much more reliable ...or OSs designed for these purposes. – Nathan C Jul 30 '13 at 14:07
I understand, but this is what I have to work with - I would much rather use Windows 2012 for routing and firewall which I can monitor and control directly rather than my DD-WRT router. – Theveloper Jul 30 '13 at 14:09
@tonyroth I'm gonna use hyperv. – Theveloper Aug 1 '13 at 3:06
up vote 2 down vote accepted

Your design is flawed and as others have said in comments, you will most likely need a separate piece of hardware to do the job, whether it's a dedicated firewall/router (i.e. SonicWall, Cisco, Juniper) or software appliance (i.e. pfSense, IPCop, IPFire).

Your network would then look like this:

Public <--> Router <--> Physical Switch <--> ESXi Host <--> Windows 2008 Server
                              |                 |
                              |                 +<--------> Other VMs
                              +<------------> Other LAN devices

This is typically the way things are set up in most enterprise environments - you have dedicated (and ideally, HA/redundant) hardware handling your NAT routing.

The reason for the separate hardware is that as you've experienced, if your router lives on the same hardware as your ESXi host and you lose the VM (or even the host), you also lose routing (along with any other service hosted by the VM/host - DNS/DHCP, etc.)

There's also an attack vector and a resource efficiency angle - are you confident enough having Windows on your edge (publicly accessible) network? Typically (I know this is subjective), a full-fledged O/S has a higher attack vector than a dedicated appliance.

Dedicated appliances have been designed from the ground up to do the job, and so have an incredibly stripped-down OS (as has been pointed out, even dedicated appliances have an OS of some description).

Low-down: get yourself a dedicated firewall; you will save yourself a lot of head/heartache in the long-run.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.