Best practice to secure single hypervisor colocated

[mylesw]

I have to install a single server at a colocated facility, and it will be running PM 5.2. I need to be able to restrict the IP addresses that can access the hypervisor, but I cannot put the server behind an external firewall as the provider is only giving me 1U and 5 network IPs. Is there a best practice for doing this on the hypervisor, so that only nominated IP addresses are able to get to a login on either the web management console or SSH?

Something that won't be overwritten with subsequent software updates, etc.?

Thanks in advance for any suggestions.

Myles

 

[zarlo5899]

you can use iptabels

 

[mylesw]

you can use iptabels

Yes, but wouldn't that be overwritten with a PM upgrade later? And also I need to be able to not have the virtual bindings to the network ports not be affected by iptables. Only access to the management of the server should be affected. Not sure how to achieve that if iptables is restricting the entire NIC itself. I only get one cat 6 drop into that server, so everything is done on the one NIC.

 

[zarlo5899]

iptables you can set destination ip

 

[mylesw]

iptables you can set destination ip

I don't understand. What rules are you referring to? How can I restrict the NIC and not have that subjected to the virtual hosts on that box? I need the virtual hosts to be unencumbered, but only the management network be restricted. And it all has to be done on one NIC. Your answer gives absolutely no details on how to do this, so I doubt you are correct. Please explain.

 

[ABaum]

The firewall section in the Manual is your friend.

 

[mylesw]

The firewall section in the Manual is your friend.

Thank you. That was the direction I needed. I see I can secure at the node level, so I think this will work. Much appreciated.

 

[koulis1234]

Hi, I have just gone through and I can say IPtables is very flexible you can do a lot really! But I wonder if a properly configured IPtables is as secure as something like Pfsense or other hardware firewall