I've been wondering about this.

Assume a host with a strong firewall setup (for example only allowing port 80). That host has some virtual machines without firewall.

Why the connections made on these virtual machines aren't rejected by the firewall in the host? At the end, the VM it's only a program running in the host like any other program.


If you're running a VM and it isn't filtered by the firewall, then it's probably operating in a bridged mode at L2 below the firewall's view of packets. To diagram:

network card  --|-- firewall ---- applications

If you're talking about Linux, then a Serverfault question discusses this as well, and there are kernel patches to change this behavior with iptables. There's also ebtables, which is designed specifically for bridged interface filtering.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.