Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the near future, my firm will begin hosting Terminal Services systems for a few business customers. The Terminal Services Servers will be VM's on one of two large VM hosts.

To provide secure access, we will be setting up a site-to-site VPN between our network and the customer. However, the client should only be able to access their virtual machines, not the machines on our LAN.

The best idea I've had so far is setting up a physical switch for each customer. Our VPN router will put each customer's traffic onto a different port, and that port will then be connected to their switch. That switch will be connected to physical NIC's on each VM host. Each virtual machine will be bridged with the physical NIC associated with the customer using the VM.

Although I think this would work, it seems overly complex and difficult to scale. Can anybody propose a better solution?

I asked a similar (but different) question before, it can be found here:

share|improve this question
up vote 4 down vote accepted

It doesn't sound too complicated to me and although I don't do much work with virtualization, I suspect that your plan is a fairly common scenario for companies that host IT infrastucture for independent, disparate customers. I would recommend using VLAN's on a single switch instead of using dedicated switches in order to reduce your infrastructure costs.

share|improve this answer
Yeah, just tag the appropriate ports and set up the ACLs for access accordingly. – MDMarra Oct 23 '09 at 0:33
We do exactly this for DMZ hosts. – Kamil Kisiel Oct 23 '09 at 2:25

You might want to consider running a virtual router & virtual switches on your vm host. Take a look at this Vyatta virtualization demo to get an idea how you could do it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.