I plan on running a dedicated firewall distro, but I want to run it in a KVM VM.

I have a machine with 2 NIC's, which I intend to assign to WAN and LAN. However, both NIC's do not support VT-d, so PCI-passthrough is a big no-go. Therefore, I had the setup in mind of using a macvtap in private mode for the WAN-interface and a standard bridge for the LAN-interface.

I was just wondering: what do I do with that WAN-interface? Let's say it's called eth0 and there's a macvtap in private mode linked to it, which gets the firewall WAN interface assigned. How do you configure the eth0-interface itself in the linux host? Do you set it to manual mode, thereby not assigning it an IP? Do you give it an IP, static or DHCP? Do you protect it also with IPTABLE rules?

I'm just wondering, how do you implement this type of setup securely that protects both the host and the virtual firewall guest from the WAN-side?

Any advice you can give is appreciated!

closed as too broad by yoonix, Jenny D, mdpc, MadHatter, Ward Jul 5 '17 at 3:12

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


Actually, you can configure parent device on host any way you want. You may leave interface in "manual" mode and add one more interface to communicate with the host OS. Or, of course, you can set static or dhcp configuration on the interface, just as you haven't been using macvtap.

The only thing to keep in mind here is that host will be unable to communicate with the firewall VM if you'll choose to assign address on parent device. That's because packets will be sent out of the parent interface to the switch and if it does not support hairpin mode (dst interface is the same as src), frames will not be passed back.

However, in your setup it's desirable that all traffic go through the firewall VM first, so you should be fine with just leaving interface in manual mode on host. This way no incoming packets will be accepted by TCP/IP stack on host and all the communications will go through the macvtap to the firewall VM.

Not the answer you're looking for? Browse other questions tagged or ask your own question.