howto set up a virtual firewall?

[Kurt Neufeld <kneufeld@burgundywall.com>]

Hey there,

I've searched high and low but can't find an answer to my problem and I
find it hard to believe that I'm the only person that wants to do this.

I would like to setup a virtual machine that is my firewall. So far I've
got Shorewall setup in a virtual machine and the "internal" nic works 
and I can ping the host and vice versa.

However, I can't figure out the "external" nic. I've setup bridging on 
my hosts eth0 (currently my internet facing nic) but if I understand

3. public bridge from http://kvm.qumranet.com/kvmwiki/Networking then I 
have to have an ip address on my host? That would defeat the purpose of 
the virtual firewall.

So what I want is to have the virtual machine have "complete" control of 
the external nic (not configured, no ip addr on host), the internal nic 
can either be on a virtual network or bridged internally, either works 
for me.

Current config at end.

Thanks for any assistance,
Kurt

ps - sorry for the previous incomplete post

<domain type='kvm'>
   <name>fw</name>
   <uuid>76bfb29c-ebd8-7d25-6009-0874d8cca460</uuid>
   <memory>262144</memory>
   <currentMemory>262144</currentMemory>
   <vcpu>1</vcpu>
   <os>
     <type>hvm</type>
     <boot dev='hd'/>
   </os>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>
   <on_crash>destroy</on_crash>
   <devices>
     <emulator>/usr/bin/qemu-kvm</emulator>
     <disk type='block' device='disk'>
       <source dev='/dev/lvm-1/vm-fw'/>
       <target dev='hda'/>
     </disk>
     <disk type='file' device='cdrom'>
       <source file='/tmp/smoothwall-express-3.0-x86_64.iso'/>
       <target dev='hdc'/>
       <readonly/>
     </disk>
     <interface type='bridge'>
       <mac address='00:50:04:7f:b5:a3'/>
       <source bridge='br0'/>
     </interface>
     <interface type='network'>
       <mac address='00:16:3e:06:8c:10'/>
       <source network='virtnet'/>
     </interface>
     <input type='mouse' bus='ps2'/>
     <graphics type='vnc' port='-1' listen='127.0.0.1'/>
   </devices>
</domain>

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/