I've been scratching my head on this issue the past few weeks. I've been searching but can't find the answer I want. Maybe I'm just bad at searching though. In any case, any feedback on this issue is welcome.
I'm running ESXi 5.5 (free) with five guests (more to come in the future). I have six public Internet ip-addresses that are routed to the physical port on which my server is connected.
What I want to achieve is this setup:
- Host has ip-address X.Y.Z.10
- Guest A has ip-address X.Y.Z.11
- Guest B has ip-address X.Y.Z.12
- Guest C has ip-address X.Y.Z.13
- Guest D has ip-address X.Y.Z.14
- Guest E has ip-address X.Y.Z.15
Currently this is achieved by configuring the ip manually on every guest. However, I want to make it impossible for Guest C to snatch the address of Guest B by changing the guest network configuration. X.Y.Z.12 should be available to Guest B only. The local administrator of each guest must have root access to its own machine.
Is this possible with ESXi alone or do I need to route all traffic through a VM running pfsense, iptables or similar? There is currently no firewall between the host machine and the Internet.
Thanks in advance.
Edit: To clarify the situation...
I have purchased my own server and I've then put it in a serverhall under a co-location agreement. In the agreement I also purchased a total of six ip-addresses. The server itself has two physical Ethernet ports, albeit only one is connected to the physical switch. The ip's are tied to my port of the physical switch, thus anything on my side that poses as ip X will get that ip, if that makes sense.
The guests are running different linux flavours, mostly Debian. Since it is my own server, resources are not an issue. Additional VM's can be put up at any time.
I understand that root administrators of the guest os's are able to edit the network files, but even if they can I don't want them to be successful. What that means is that if they change their network configuration it shouldn't work because they only have one of the ip's assigned to their virtual nic, not all of them.
Edit 2 Current configuration after VyOS setup (see comments)