Achieving Isolation for Sec (vm->vm & vm->Hyper)

[vingal]

Building proxmox box which will host 20+ VMs.

Need to ensure that:
1. VMs cannot talk to hypervisor, but VMs can all reach the internet
2. VMs cannot talk to other VMs
3. VMs cannot read or write to other VMs
4. Need to ensure that VMs cannot read or write to hypervisor

Purpose is to avoid malware moving from vm->vm or from vm->host.

How do I achieve this ?

Please & Thank you!

 

[grepler]

Use PVE Firewall and (or, but preferably and) separate VLAN/networks for physical hosts and VMs.

https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html

 

[vingal]

Use PVE Firewall and (or, but preferably and) separate VLAN/networks for physical hosts and VMs.

https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html

Would you mind being a little more specific please?