vmware firewall

[travisdh]

Hi All,

Hopefully someone might be able to chime in and give me an idea on if what I am trying to achieve is possible (and also sensible).

Anyway in my quest to lower power usage, I am looking at all of the machines I am running and which I can consolidate. Currently I have a vmware esxi server which runs a number of my virtual machines, and then I also have an older IBM machine which is running pfsense as my firewall / gateway / router. The pfsense machine is given a half-bridged external IP from my modem and then handles the routing to and from my network, does IDS and a number of other things.

Anyway the issue is that the machine is not an efficient machine, uses a bit of power, and I have spare capacity in my esxi server to easily handle a number of these kinds of virtual machines.

I am keen to try and keep security as good as possible, so I don't want to just join the modem into my main switch since it would expose security issues, so my thought was I could put another network card in my physical server (esxi server) and create a virtual machine for the pfsense firewall, assign a physical network port to the pfsense machine (for the WAN) and this port would only be assigned directly to the virtual machine (e.g. not shared through a virtual switch), and then one of the normal network ports of the esxi machine can be the LAN network port which is post firewall and should be fine to be shared with other machines.

Optionally I could also have a virtual switch for DMZ and move my web servers, email servers etc into the DMZ zone for additional security preventing me having to open ports into my internal network.

Would the above be possible, and am I right in thinking as long as I assign a physical port to the firewall, then it should be as secure as a physical machine in place since the network port would only be for the firewall virtual machine, and not management, or any other internal network related port?

Appreciate your thoughts.

[Pete]

Here I am still in learning mode using the PFSense firewall.

It is way different than the Smoothwall box that I have been using for many years now.

I am no expert with it.

Looking over at the PFSense forum it appears that there are already folks doing similiar to what you want to do. That and many folks just use VLANs to separate stuff using single ports.

Would the above be possible, and am I right in thinking as long as I assign a physical port to the firewall, then it should be as secure as a physical machine in place since the network port would only be for the firewall virtual machine, and not management, or any other internal network related port?

Yup. You can also further divide stuff up. You can create a management VLAN for your managed switches / firewall. Its really up to your imagination with PFSense. All of the default configurations are there.

You can also create rules sets groups so you don't have to recreate individual rules.

Here I went with an mITX board and two two port Intel Gb Nics plus the two built into the motherboard (realtek). I am looking at it for load balancing more than one wan connection and multiple lan connections. It was built from a "collection" of a bunch of old hardware never utilized.

I just had a look at the graphing utilities and its hardly working at all.

Going very slow; baby steps.

[madmax]

I ran pfsense as a VM on esxi for several years. I have a managed switch so I just used VLANs. So, the cable modem went right into the switch on a separate vlan. The esxi system had 4 ethernet posts but I just bound them all with link aggregation. After many years of running like this (maybe 5 years?) I recently got an n2800 based mini its to run pfsense instead. I got tired of losing internet access any time I worked on/had to reboot the esxi host. It's definitely doable though.

[travisdh]

Thanks Guys,

I rarely reset my vmware server so downtime is not really a big issue. Since it also has two NICS, I dedicated one NIC to a virtual switch, as the WAN interface of the pfsense server, then the other NIC and virtual switch handles all 'firewall protected' traffic, it seems to work quite well

[reidfo]

You may also want to check out Vyatta. It's an enterprise grade software firewall build for virtualization. The community edition is free. It's a bit of a learning curve, but it's every bit as good as (or better than) a Cisco ASA. I have mine handling separate voice and data VLANs, two DMZs, VPN, caching transparent proxy server, two internet connections with intelligent routing (voice traffic goes over DSL, everything else on Cable). I'm running it all on a Supermicro Atom-based 1U server. I could have virtualized, but I preferred a separate device.