Is isolation of VM's, located in the same VLAN, possible?

[DanH]

We have several VM's which are running on the same Proxmox cluster within the same VLAN. They all connect to the gateway, which is a separate firewall appliance..
Is it possible to isolate those VM's from each other, just having VM and firewall communicate, but communication between VM's is not possible?

It's somewha like client isolation in a Wireless (WLAN) network in a hotel. Each device is connecting to the AP and can talk with the internet, but none of the clients would ever see any other WLAN devices.

Is something simolar possible with the VM's? I guess it should.
Yes, I could use separate VLAN's, but we'd prefer this working similar to the WLAN solution.

If there is a way, could you give me a hint how it might be achieved?
I believe it might be done with the Proxmox VE Firewall. So far, we never used it and there is a lack of understanding on our side.
If that is the way to go, is there a simple description, tutorial or other document explaining all step by step?

We do not intend to use Proxmox Firewall (yet) beyond this basic need.

Thanks
Dan

 

[louie1961]

I can't think of a simpler way, but what you can do is block all traffic on the Proxmox firewall except to the IP of the gateway. The Proxmox firewall operates at three levels: You can set it at the datacenter level, the node level or the VM level. I am not sure but I am thinking you would need to do this either at the VM level or maybe there is a smart way to do it at the Node level?

 

[fabian]

https://bugzilla.proxmox.com/show_bug.cgi?id=4300

 

[DanH]

https://bugzilla.proxmox.com/show_bug.cgi?id=4300

@fabian: Cool! I see that there are others that would love to see this too.
Great that there is a patch, and I hope it will be implemented soon.
I will wait eagerly....

Until then, I probably will have a look to the firewall suggestion from @louie1961

Thanks
Dan