Running a Virtual Router & Firewall inside VMware ESX with Vyatta

by David Davis on September 18, 2008

In this video, you will learn how to run a Virtual Router & Firewall inside VMware ESX with Vyatta.

{ 3 comments… read them below or add one }

Hussain 01.02.09 at 10:12 am

Hello Mr.David,
Firstly, let me thank you for your great work that you have done. secondly, I have a question about a vFirewall desiging along with VMware Network Topology as well as across VLANs.

I have an ISA Firewall 2004 that configured with 2 pNICs, external & internal.



Clients configured with Gateway to access the internet.

Also, I have VMware ESX Cluster consists of 4 hosts. Each host with 6 pNICs 2. I have a Routing Switch that configured with 4 vLANs. Switch IP Address In the pSwitch, 4 VLANs are configured;

Service Console is connected in vLAN3 which is Network, under vSwitch0 contains 2pNICs & 3 PortGroups. Service Console PortGroup, VMotion PortGroup & vCenter PortGroup. vCenter PortGroup I use it to place the VirtualCenter VM & I will place the VM Firewall.

I want to restrict the access to the Virtual Center & ESX farm between the & Network.

Currently, I’m accessing the VirtualCenter on Network by adding a Static Route on the Vi-Clients to go via “The pSwitch IP Address”. I can simply reach to the network, but it doesn’t provide me any security on Access-Rules and Port Restrictions.

Once I place the vFirewall in the vCenter PortGroup, and I assigned 2 vNICs one to be for the Production & the other for the vCenter PortGroup. How can I configure the routing between the ISA Firewall “Front-end Firewall” with the vFirewall “Back-end Firewall”????

In a Back-to-Back Firewall Scenario, the Internal Network behind the Front-end Firewall, becomes a [b]DMZ Network[/b], yeah? I have done the following to get it work, but unfortunately, I cant get it work.

I have Setup another Virtual ISA Server to serve the vLAN3 segment &
configured it with 2 vNICs;

IP Address:
DG: -> Internal Address of the Front-end ISA Firewall

IP Address:

1. In the Back-end ISA Server, I have created the ~ as a DMZ Network.
2. Created a Route Relationship between default Internal Network behind the
Back-end ISA Server and the DMZ Network
3. For testing purposes, I have created a Computer-Set for the ESX Servers &
DMZ Clients & Created Access Rule All Outbound Protocols from Default
Internal Network behind the Back-end ISA Server to DMZ Network. And Added
both elements in this Rule as a Source & Destination
4. In the DMZ Clients. I Remove the mask Static Route & Added mask “External Interface of the Back-end ISA Server”.
5. Configured the Front-end ISA Server with the Default Internal Network
behind the Back-end ISA Server “”.
6. Configured a Static Route entry in the Front-end ISA Server

DMZ Client configured with:
IP Address:
S.M: 16 bit
D.G: “Front-end ISA Server Internal Nic”

As soon as I remove the Static Route mask from the DMZ Clients, I lost the connectivity to the Network.

I want to enable the DMZ clients to access the network using Limited Access-Rule. Can I do that?

Many Thanks in advance.

Danny 07.16.11 at 12:06 pm


Thanks for the video. I purchased your vSphere troubleshooting series. Quick question…Have you setup a virtual switch which acts as a gateway for your vms to pass through the firewall?

For example: You have a vm switch connected to a NIC attached to the firewall vm – Then you have another vswitch connected to the virtual machines but with no nic. The two vswitches are connected to each other. Would something like this work?

David Davis 07.16.11 at 10:33 pm

Hi Danny
Thanks for your support of my Troubleshooting Video!
With Vyatta, I don’t believe I have ever tried anything more than you saw in this video. However, what you are describing is perfectly doable. Just create two vSwitches and then have the firewall VM have two vNICs, one in each vSwitch. One vSwitch is the private / inside network and the other vSwitch is the ‘public’ / outside / unsecured network. Hope that makes sense!
Thanks for your comments!

Leave a Comment

You can use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Previous post:

Next post: