5

I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup, where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, I guess). I'll pick up 2+ port NIC for the firewall and I'll PCI-passthru to it. WAN traffic goes in to the firewall's NIC port 1 and port 2 connects to LAN via switch.

Rationale for virtualizing the firewall vs firewall on host with virtual fileserver is that I can make the firewall's drives read-only in a way that can't be overridden from the VM even if penetrated. I hope that would make some escalation exploits ineffective.

The question is: am I missing anything obvious? Does that rationale make sense to you? Would opting for paravirtualization affect the security?

  • I would even go as far as virtualizing a full firewall OS like pfsense. and route all traffic through it (so the router/firewall is the only one talking to the 'net' the rest all talk on a virtual network through the pfsense.) – LvB May 22 '15 at 23:47
  • @LawrivanBuël All traffic would be routed thru the firewall, only WAN line goes into it. Dedicated firewall OS makes a lot of sense, I would likely step into a pitfall brewing my own. Thanks for the tip. – WhimsicalWombat May 22 '15 at 23:51
  • evaluate some of the possibilities, I use pfsene because its BSD.but there might be a better solution for you out there ;) – LvB May 22 '15 at 23:52
  • @LawrivanBuël Will do. I'll likely opt for Linux based since I'm familiar with it but I'll do my due diligence and pick one. – WhimsicalWombat May 23 '15 at 0:01
  • Snort is another good NIDS/NIPS – cremefraiche Jun 3 '15 at 7:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.