Libro sobre Proxmox maestria
Chapter 5
Network #2 - multitenant environment This network setup is almost the same as the previous network with the added benefit of fully multitenant virtual platform. In a physical firewall, we can only add a very small number of NICs to provide Internet connectivity to isolated subnets. Using a virtualized firewall, we can add as many firewalls or vNICs as we want. This setup is especially useful when multiple, isolated client subnets need to be hosted and each subnet requires its own firewall control for filtering purposes. In this example, vmbr0 is directly served by the physical firewall. Bridge vmbrl and vmbr200 have their own virtualized firewalls. The firewalls also act as bridges between bridges. For example, the firewall for subnet 2 has two vNICs. One of these setups was WAN, where vmbr0 acts as an Internet provider. The second vNIC is LAN-facing, which serves the subnet 2.
This is a common scenario for infrastructure service providers who host virtual networks for multiple clients. Since multiple companies can access their virtual networks remotely, it puts extra workload on the physical firewall. Single-point firewall failure should be avoided at all costs by creating a cluster of physical firewalls to provide load balance and failover firewall service.
Never use a virtualized firewall on the same cluster to connect to the Internet directly. Always use separate physical hardware as the main firewall to act as a barrier between the Internet and internal network.