In the near future, my firm will begin hosting Terminal Services systems for a few business customers. The Terminal Services Servers will be VM's on one of two large VM hosts.
To provide secure access, we will be setting up a site-to-site VPN between our network and the customer. However, the client should only be able to access their virtual machines, not the machines on our LAN.
The best idea I've had so far is setting up a physical switch for each customer. Our VPN router will put each customer's traffic onto a different port, and that port will then be connected to their switch. That switch will be connected to physical NIC's on each VM host. Each virtual machine will be bridged with the physical NIC associated with the customer using the VM.
Although I think this would work, it seems overly complex and difficult to scale. Can anybody propose a better solution?
I asked a similar (but different) question before, it can be found here: http://serverfault.com/questions/76479/is-it-possible-to-link-discrete-vpn-networks