Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In the near future, my firm will begin hosting Terminal Services systems for a few business customers. The Terminal Services Servers will be VM's on one of two large VM hosts.

To provide secure access, we will be setting up a site-to-site VPN between our network and the customer. However, the client should only be able to access their virtual machines, not the machines on our LAN.

The best idea I've had so far is setting up a physical switch for each customer. Our VPN router will put each customer's traffic onto a different port, and that port will then be connected to their switch. That switch will be connected to physical NIC's on each VM host. Each virtual machine will be bridged with the physical NIC associated with the customer using the VM.

Although I think this would work, it seems overly complex and difficult to scale. Can anybody propose a better solution?

I asked a similar (but different) question before, it can be found here: http://serverfault.com/questions/76479/is-it-possible-to-link-discrete-vpn-networks

share|improve this question

2 Answers 2

up vote 4 down vote accepted

It doesn't sound too complicated to me and although I don't do much work with virtualization, I suspect that your plan is a fairly common scenario for companies that host IT infrastucture for independent, disparate customers. I would recommend using VLAN's on a single switch instead of using dedicated switches in order to reduce your infrastructure costs.

share|improve this answer
1  
Yeah, just tag the appropriate ports and set up the ACLs for access accordingly. –  MDMarra Oct 23 '09 at 0:33
    
We do exactly this for DMZ hosts. –  Kamil Kisiel Oct 23 '09 at 2:25

You might want to consider running a virtual router & virtual switches on your vm host. Take a look at this Vyatta virtualization demo to get an idea how you could do it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.