Running a firewall in a VM is convenient but risky
Running a firewall inside a VM can make backups and upgrades much easier. A new firewall version or a different firewall product can be tested by creating another VM and changing the , without moving physical cables.
The main risk is a bad setup that accidentally exposes the whole home network to the internet. Another concern is the somehow receiving an outside internet address when it should not.
One possible setup is to connect the internet line to at least two nodes through a simple switch, so the firewall VM can move between nodes and keep internet access running. The downside is that internet access can still fail if the whole cluster or the NAS goes down.
Key points
- A firewall VM can be easier to back up, replace, and test than a separate physical firewall.
- settings can change the setup without moving cables.
- A wrong setup could expose the internal network to the internet.
- The must not accidentally receive the outside internet address.
- A two-node setup can help keep internet running during moves, but the cluster or NAS can still become a failure point.