I want to protect individual VMs on a vSphere/ESXi host with firewalls rules using a solution that works directely on the hypervisor. By default vSPhere does not allow that, right? It has to support a clustered setup of course. What are my options?

What is not an option for me is: - Running a firewall as a VM and bridging all the VMs behind that. - Using the Windows build-in firewall since they want admin to the OS and hence can just disable the Windows Firewall.

A scenario would be one VM where you give a user access to. But from that machine he should be totaly isolated from the rest of the network. So he should not be allowed to access any other machine. Even not the ones on his own subnet


For VMware vSphere, the right firewalling solution is the VMware vCloud Networking and Security (formerly vShield) module available with the paid product (Essential Plus tier and above $$$).

This would allow granular controls and network monitoring of VM's, including those on the same subnet.

It works by inserting a filter on the configured interfaces of your VM in the .vmx file. Traffic is filtered through a set of vShield virtual machines (a management VM and a firewall per host):

ethernet0.filter0.name = "vshield-dvfilter-module"
ethernet0.filter0.param1 = "uuid=50048229-580b-7327-832e-1390c8c98044.000"
ethernet0.filter0.onFailure = "failClosed"

If the vShield virtual machines fail, VM traffic on the configured VM's will halt by default.


The hypervisor does not perform firewalling or NAT on its VMs. It's intended to function as if it's not there from a network standpoint.

With that said, if you want logical network separation between VMs you'll have to do it using a more conventional network method. This will come down to host-based firewalls, VLANs, tight access controls, or even more complex methods like RADIUS authentication.

  • 1
    There are hypervisor-add-on products now that do firewalling and other network security functions. – mfinni Feb 14 '13 at 15:04

There are also 3rd-party hypervisor-based firewalls. I had decent experience with Juniper VGW : http://www.juniper.net/us/en/products-services/security/vgw-series/

  • Is it a lot of $$$??? – ewwhite Feb 14 '13 at 15:26
  • I honestly couldn't tell you. It was implemented as part of a high-visibility, well-resourced PCI project, so I'm sure that it wasn't cheap. – mfinni Feb 14 '13 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.