2

I am looking to set up a hardware firewall for my home network. However, I am but a poor lowly student so I'm looking to virtualise to reduce hardware costs.

Now for a diagram to explain what I have in my head (and also because I just like diagrams):

  +----------+
  | Internet |
  +----------+
       ‖
       ‖      Server running
       ‖        Hypervisor
+------O-------------------+      = and ‖ both represent network connections
|      ‖ WAN        DMZ    |
| +---------+   +--------+ |      The "O" symbol indicates a physical NIC
| | pfSense |===| Debian | |
| +---------+   +--------+ |      pfSense and Debian are both VMs
|      ‖ LAN               |
+------O-------------------+      The Debian VM will run an Apache server
       ‖
       ‖                          The Hypervisor ONLY exposes its management
    +-----+                       interface on the LAN NIC
    | LAN |
    +-----+

Now clearly having two physically separate machines is preferable to the above from a security standpoint, as the WAN attack surface is reduced. My question is by how much is the attack surface reduced?

I do not have an affinity for any particular hypervisor however given my testing so far the free VMware vSphere Hypervisor is looking to be the best.

Improve this question
0

2 Answers 2

Reset to default
1

When done properly, virtualizing a firewall securely is possible and shouldn't be less secure than the traditional separate hardware. Nowadays, the term that's been buzzing in software defined networking (SDN) circles is network function virtualization, also known as virtualized network function.

Network function here refers to network functionalities like intrusion detection and prevention, firewall, routing, etc.

Virtualization is the use of one powerful machine that runs multiple virtual machines that runs virtualized network application, replacing multiple physical hardware network applications.

As another answer briefly mentioned, the main limitation of virtualized firewall is essentially throughput, but if you're talking about home networking, this shouldn't be an issue.

Improve this answer
2
  • SDNs are very interesting, I will be doing plenty of reading on the topic, so thank you for introducing me. One question: In an enterprise environment would a software defined network be protected by a separate firewall/IDS/IPS appliance running something like Snort with a ruleset tailored for protecting the Hypervisor, or are there Hypervisors out there specifically designed for this purpose?
    – o.comp
    Jan 9, 2017 at 12:24
  • 1
    Yes! It would generally. However, we are now seeing global-scale SDN's such as Azure and Amazon Web Services where you may no longer be concerned with whether things are hardware or software based. In Azure, for example, any SDN you set up is protected by a virtual firewall though you can choose to add higher-spec virtual firewalls with IDS, etc. if you want to. But these virtual data centres have additional physical and virtual protection in many layers since they service so many customers that the risks and the impact of failure runs to $$$b.
    – Julian Knight
    Jan 12, 2017 at 15:06
2

The main problem with running that in a VM is throughput. Your router/firewall needs to be able to process packets and route them very quickly and at high volume. This isn't always easy to achieve with a VM.

Also, I'm not really sure why you are doing it this way. What happened to your router? That is probably perfectly capable of doing what you want. Certainly, I wouldn't choose to connect a machine direct to the Internet if I could help it. One problem you will have is that the host computer will be exposed so any vulnerabilities could also expose the guests. To say nothing of the whole lot collapsing from time-to-time under the load (depending on the host resources) and having to be regularly restarted to install host OS patches.

If your needs are fairly limited, you could also consider a single board computer with a second network port added which would act as a router/firewall.

Improve this answer
4
  • Thanks for the answer! With regards to your comment "I wouldn't choose to connect a machine direct to the Internet", I completely agree, however I question whether a Hypervisor, in this case ESXi, is likely to be more vulnerable than whichever operating system lies under the firewall software, in this case FreeBSD, and hence whether the attack surface is really so different.
    – o.comp
    Jan 8, 2017 at 21:11
  • 1
    Yes, there is a difference since FreeBSD is generally pretty secure, especially if stripped down to act purely as a firewall. Hypervisors are not designed to sit on the Internet, not to say that they aren't secure but I wouldn't personally want to do that. You could always try it and see ;-)
    – Julian Knight
    Jan 8, 2017 at 21:16
  • 1
    @JulianKnight related to your answer, perhaps the router is not trusted, or since the OP is a "poor lowly student" it's a "free" ISP-owned router, or just an older model that never got updated for shellshock. I'd rather connect a hypervisor to the internet than an old router.
    – lorenzog
    Jan 9, 2017 at 9:32
  • 1
    @lorenzog, reasonable point and one covered in another Q recently. However, in that case, the OP does have a router, even if there is little trust in it. The Q should be clarified. Either way though, the best approach is to use a dedicated device configured specifically to act as the edge point to the network. There can be no doubt that using a hypervisor is slightly more risky. But probably not really enough to worry about.
    – Julian Knight
    Jan 12, 2017 at 15:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .