I'm putting my server to use as a file server and a firewall. I'm looking at KVM or Xen VM setup, where file server and firewall get their own VMs and host is just supplying the hardware (so Xen way, I guess). I'll pick up 2+ port NIC for the firewall and I'll PCI-passthru to it. WAN traffic goes in to the firewall's NIC port 1 and port 2 connects to LAN via switch.
Rationale for virtualizing the firewall vs firewall on host with virtual fileserver is that I can make the firewall's drives read-only in a way that can't be overridden from the VM even if penetrated. I hope that would make some escalation exploits ineffective.
The question is: am I missing anything obvious? Does that rationale make sense to you? Would opting for paravirtualization affect the security?