Running pFSense virtually, trying to save $ in DC

J

justinthetech

n00b
Joined
May 9, 2009
Messages
13
Hey guys I have a question for you VMware users. I'm looking to purchase a server to colocate to a datacenter. I'm trying to get away with only having to get 1u and one data drop. I don't want to add a separate 1u for a dedicated firewall.

I want to virtualize pfsense in ESXi and have one NIC connect to the physical NIC of the host then use a virtual LAN interface to connect to my VMs. I know from a security standpoint this is not the best scenario. What can i expect from a performance standpoint?

Im planning to run a few different AD environments with Exchange servers.

Are any of you running the same setup?

Here is a PDF of a Visio map I put together to illustrate.
http://dl.dropbox.com/u/423971/Visio-DCplanDrawing.pdf
 
I virtualise my router, only have one physical connection to the server; works fine.

Going to try out astaro at some point since pfsense is taking forever to stable 2.0
 
virtualizing your firewall is not a good idea, keep your firewall dedicated as a single machine or don't do it at all.

This was covered already, a few threads ago.
 
I wouldn't say it is a blanket bad idea. Its probably a bad idea if you have 4000 concurrent users accessing your app though :)

First question I would ask is whether you can reuse an existing firewall - do you need a separate one? Is there no other corporate one which you could hang off, perhaps in an application specific DMZ?
 
I ran Endian as a VM in my home environment for many months without any problems. Just make sure to have a physical firewall to replace it should the VM go offline for whatever reason.

I would also dedicate a NIC or VLAN a port group specifically for the WAN port of the virtual firewall. Don't have it mingle with your internal traffic.
 
It isn't as bad as you might think. We have a client we are actually building a virtual setup for. They are a a NPO with about 40 people at each site with a 15/2 TWC business class line. So being a NPO money is tight and we are trying to virtualize to save money for them.

We are going to be using HP ML150s with a single Intel E5620, 12GB of RAM, 3x 1TB SATA drives in RAID 5, VMware ESXi 4.1, and 3 physical NICs. We have a demo unit in the office and it is running great. We are using pfSense as the firewall, Microsoft Forefront Threat Management Gateway as content filtering / Gateway AV, then we are also putting a DC and a File server on each box.

Eth0: Virtual Switch 1, WAN for pfSense
Eth1: Virtual Switch 2, LAN for pfSense
Eth2: Virtual Switch 3, VLAN1, TMG in, VLAN2, TMG out / ADFS LAN / VMWare management.

For a small organization this is actually a really good setup, not to mention we are providing Licensing through SPLA so they have a very low TCO (which for a NPO is key). We looked into doing Tier 1 UTM devices (Sonicwall, Juniper, Cymphonics, Untangle, Astro) but found that at the end of the day this was the cheapest solution and even being virtual had no negative effects because everything is separated by physical NICs.
 
Its good to see real world examples like this C7J0yc3.

As of Friday my server has been online in the datacenter. I'm running a Poweredge 1950 with the ESXi loaded on a thumb drive. pFsense is running the Edge connection in a VM.

Seems to be running good so far. Performance between the vswitches for my Exchange servers is fast.
 
justin your visio link seems to be broken. I would be interested in seeing how you layed this out.
 
C7J0yc3 said:
It isn't as bad as you might think. We have a client we are actually building a virtual setup for. They are a a NPO with about 40 people at each site with a 15/2 TWC business class line. So being a NPO money is tight and we are trying to virtualize to save money for them.

We are going to be using HP ML150s with a single Intel E5620, 12GB of RAM, 3x 1TB SATA drives in RAID 5, VMware ESXi 4.1, and 3 physical NICs. We have a demo unit in the office and it is running great. We are using pfSense as the firewall, Microsoft Forefront Threat Management Gateway as content filtering / Gateway AV, then we are also putting a DC and a File server on each box.

Eth0: Virtual Switch 1, WAN for pfSense
Eth1: Virtual Switch 2, LAN for pfSense
Eth2: Virtual Switch 3, VLAN1, TMG in, VLAN2, TMG out / ADFS LAN / VMWare management.

For a small organization this is actually a really good setup, not to mention we are providing Licensing through SPLA so they have a very low TCO (which for a NPO is key). We looked into doing Tier 1 UTM devices (Sonicwall, Juniper, Cymphonics, Untangle, Astro) but found that at the end of the day this was the cheapest solution and even being virtual had no negative effects because everything is separated by physical NICs.
Click to expand...

a little off topic but why was the decision made to run both pfSense and TMG? why not just use TMG?
 
bad from security standpoint, but it shouldn't be so bad....unless you have heavy user traffic//concurrent connections.
 
I always wondered why this is bad from a security standpoint if you dedicate a nic for the wan and give it a separate vSwitch within ESX. The vSwitch networks and the VM's are isolated from each other...
 
Heres my esx vSwitch setup and as far as I know this isn't a security issue. Not that it matters, its only my home network but I did run a PROD network like this except the firewall was TMG and the configuration was supported by Microsoft.

vSwitchSetup-home.png
 
RiDDLeRThC said:
I always wondered why this is bad from a security standpoint if you dedicate a nic for the wan and give it a separate vSwitch within ESX. The vSwitch networks and the VM's are isolated from each other...
Click to expand...

I can think of a number of things:

1. You are trusting the separation facilities of the VMWare OS not only to isolate the VM's from eachother within its memory etc but also from the host itself.

The quote from Theo de Raadt springs to mind : http://www.c0t0d0s0.org/archives/3651-Theo-de-Raadt-about-virtualisation.html - You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.

A quick look at 2010-1142 - CVE - Common Vulnerabilities and Exposures (CVE) database is interesting http://www.vupen.com/english/advisories/2010/0852 - see "The ninth issue is caused by an error in the virtual networking stack, which could cause a guest operating system to send memory from the host vmware-vmx process to the virtual network adapter and potentially to the host's physical Ethernet wire."

Also see CVE-2009-2267, CVE-2008-4915, CVE-2008-4279, CVE-2007-5671.

2. Attacks against the hypervisor itself can provide a manner of opportunities from DOS attacks to elevation in privileges - for example CVE-2009-1244, CVE-2008-4917, CVE-2008-4916.

3. The propensity to make mistakes is increased considerably. In any disaster poll, human error is at the top of the list. One wrong click and your internal network is mapped onto the internet.

All the technical issues above have been patched but this is software. It is going to go wrong. It will have bugs. This is something you have to accept, even at EAL4. Virtualisation massively increases the target opportunity. But its not a bad idea. You just have to understand the risks and mitigate them where possible.
 
You must log in or register to reply here.
Back
Top