To run a Firewall in a VE

[Elmer]

Hello,

My purpose is to set a firewall into a VE to protect all the others VE and the host itself. So i would set the public ip + a private ip to a "firewall VE". And the host would have a private ip.

Internet ---> VE Firewall ---> Others VE & Host.

I hope I was clear enough

Do you think it should work ? Do you think it's a good idea ?

Now I wonder 2 questions:
1) Is it true I cannot use (bridged) openvz for my firewall VE, because openvz uses same kernel as host ? I can only use bridged kvm?
2) Is there any risk of bottleneck for my complete box ? Actually I use a bonded 2x100mb/s for the host connexion. Im scared the internal connection of the firewallVE would cap all my traffic ?

Thanks
elmer

 

[tom]

Hello,

My purpose is to set a firewall into a VE to protect all the others VE and the host itself. So i would set the public ip + a private ip to a "firewall VE". And the host would have a private ip.

Internet ---> VE Firewall ---> Others VE & Host.

I hope I was clear enough

Do you think it should work ? Do you think it's a good idea ?

Now I wonder 2 questions:
1) Is it true I cannot use (bridged) openvz for my firewall VE, because openvz uses same kernel as host ? I can only use bridged kvm?
2) Is there any risk of bottleneck for my complete box ? Actually I use a bonded 2x100mb/s for the host connexion. Im scared the internal connection of the firewallVE would cap all my traffic ?

Thanks
elmer

you cannot protect the host if you run a firewall as a guest. so you also need a firewall on the host.

 

[Elmer]

Why ?
Since every ip packets would pass through the firewall VE before reaching the OS of the host (proxmox), the host would be protected, wouldnt it ?


Here is the same project: http://www.prevelakis.net/Papers/VirtualFirewall.pdf
And apparently, it's working well.

"So the question is really why a separate firewall on a virtual machine, rather than a firewall as part of the base OS. It is fair to say that keeping the firewall separate simplifies its administration, as its configuration and maintenance is completely separate from that of the rest of the OS. This allows the management of the firewall to be carried out without requiring the cooperation of the workstation user which may be a considerable ad-
vantage in centrally managed environments."

 

[tom]

Why ?
Since every ip packets would pass through the firewall VE before reaching the OS of the host (proxmox), the host would be protected, wouldnt it ?

no. if your read the pdf, there is a sentence

"The host operating
system has minimal access to the network (enough to support bridging between the guest
VM running the Virtual Firewall and the network)"

Proxmox VE has full access to the network, therefore you need a firewall on Proxmox VE.

Here is the same project: http://www.prevelakis.net/Papers/VirtualFirewall.pdf
And apparently, it's working well.

"So the question is really why a separate firewall on a virtual machine, rather than a firewall as part of the base OS. It is fair to say that keeping the firewall separate simplifies its administration, as its configuration and maintenance is completely separate from that of the rest of the OS. This allows the management of the firewall to be carried out without requiring the cooperation of the workstation user which may be a considerable ad-
vantage in centrally managed environments."