I am managing a couple of VPS-es on an old platform I would like to no longer maintain. We used a widely used commercial VPS control panel to create the VPS-es in question.

The customers may access their VPS-es with root access.

We got a high availability cloud on VMware vSphere, and would like to use VMware to host our KVM VPS-es now :)

It's an OVH product. So we cannot add a hardware firewall to serve the VM's with NAT on different vLAN's. We do not plan on using the VMware tools (some malware may "recognize" the VMware tools apparently).

I am wondering what will be the best way to host the VPS-es with decent security since I know it's possible sometimes to sniff other VPS network traffic.

** QUESTION: What the best between: **

1) A VM firewall routing all traffic in NAT to different VLANs to the VPS (each customer having his own VLAN)


2) Setup the VM's on the VM Network (public access to the internet). All VPS-es are protected by a software firewall + the OVH firewall and anti-DDoS (VAC)

My thoughts :

  • A VM firewall can get hacked. If it gets hacked, then all our VPS-es will be affected. Not a good idea then.

  • Other companies are using stuff like SolusVM. VMware will always be better, even if all VM's are on the same network. If the VM's are protected with a firewall then everything should be fine.

  • All traffic ends up by going in the VM Network. It all uses the same interface - if there is malware, it may infect all VM's anyway.

What's best to do exactly?

  • 2
    Welcome to Information Security! Would you mind clarifying your question? Clarification will help the community understand your question in one reading and will ensure they are providing an accurate answer. For example, I would arrange the question with the background/reason for asking up front, a clean description of the before and after config changes, a bulleted list of concerns, and finally, one pointed question. When you have multiple questions in your post, it can leave the reader confused as to what you are asking. – amccormack May 15 '15 at 13:05
  • Would a customer be able to set their NIC to promiscuous mode and sniff other customers' traffic? – SilverlightFox May 16 '15 at 9:22
  • @SilverlightFox depends. By default ESXi/VSphere disallows this. You can enable it per guest basis or globally. – vidarlo Dec 14 '17 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.