Re: howto set up a virtual firewall?

[Avi Kivity <avi@qumranet.com>]

Kurt Neufeld wrote:
> Hey there,
>
> I've searched high and low but can't find an answer to my problem and I
> find it hard to believe that I'm the only person that wants to do this.
>
> I would like to setup a virtual machine that is my firewall. So far I've
> got Shorewall setup in a virtual machine and the "internal" nic works 
> and I can ping the host and vice versa.
>
> However, I can't figure out the "external" nic. I've setup bridging on 
> my hosts eth0 (currently my internet facing nic) but if I understand
>
> 3. public bridge from http://kvm.qumranet.com/kvmwiki/Networking then I 
> have to have an ip address on my host? That would defeat the purpose of 
> the virtual firewall.
>
> So what I want is to have the virtual machine have "complete" control of 
> the external nic (not configured, no ip addr on host), the internal nic 
> can either be on a virtual network or bridged internally, either works 
> for me.
>   

Assuming you have eth0 on the host, tap0 on the host visible as eth0 in 
the guest, and tap1 in the host visible as eth1 in the guest, you can 
add a bridge between eth0 and tap0, and use tap1 as the nic in the host 
for IP (e.g. run 'dhclient tap1' to obtain an internal IP address).


-- 
Any sufficiently difficult bug is indistinguishable from a feature.


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/