Firewall for a virtual network and related techniques

• US 9,888,055 B2
• Filed: 03/07/2014
• Issued: 02/06/2018
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: ProfitBricks GmbH (ProfitBricks, Inc.)
• Original Assignee: ProfitBricks GmbH (ProfitBricks, Inc.)
• Inventors: Wood, Conrad N., Weiss, Achim
• Primary Examiner(s): Gilles, Jude Jean
• Application Number:
  US14/200,948
• Publication Number:
  US 20140280911A1
• Time in Patent Office: 1,432 Days
• Field of Search: 709224, 709221, 709220
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 49/00 Packet switching elements
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30

Abstract

A system for filtering traffic in virtual networks includes a first virtual machine executed by a first physical server connected to a physical network and a second virtual machine executed by a second physical server connected to the physical network. The first and second virtual machines are connected to a same virtual network. A first firewall module is executed by the first physical server and a second firewall module is executed by the second physical server. The firewall modules are configured to filter network traffic received by the physical servers and addressed to the virtual servers.

Claims

1. A system comprising:

a first server device executing a first virtual machine and connected to a physical network;

a second server device executing a second virtual machine and connected to the physical network, wherein the first and second virtual machines are connected to a same virtual network;

a first firewall module that functions as a firewall for the first virtual machine and a second firewall module that functions as a firewall for the second virtual machine, the firewall modules configured to filter network traffic received by the physical servers and addressed to the respective virtual servers;

wherein the first firewall module is executed by a core processor of the first virtual machine and the second firewall module is executed by a core processor of the second virtual machine;

wherein the first and second firewall modules each include a superset of the same firewall rules.

2. The system of claim 1 wherein the firewall modules are configured to filter the network traffic prior to the network traffic being received by the virtual network.

3. The system of claim 1 wherein the firewall modules are configured to filter the network traffic based on custom traffic filters.

4. The system of claim 3 wherein the custom traffic filters include a rule to filter traffic based on a client ID of a client that owns a virtual machine.

5. The system of claim 3 wherein the custom traffic filters include a rule to filter traffic based on which virtual machine generated the traffic filter.

6. The system of claim 3 wherein the custom traffic filters include a rule to filter traffic based on a virtual network identifier.

7. The system of claim 3 wherein the custom traffic filters include a rule to filter traffic based on a virtual machine that is a recipient of the traffic.

8. A method comprising:

executing, by a first server device connected to a physical network, a first virtual machine;

executing, by a second server device connected to the physical network, a second virtual machine, wherein the first and second virtual machines are connected to a same virtual network;

executing a first firewall module to function as a firewall for the first virtual machine and a second firewall module to function as a firewall module for the second virtual machine, the firewall modules configured to filter network traffic received by the physical servers and addressed to the virtual machines;

wherein the first firewall module is executed by a core processor of the first virtual machine and the second firewall module is executed by a core processor of the second virtual machine

wherein the first and second firewall modules each include a superset of the same firewall rules.

9. The method of claim 8 wherein the firewall modules are configured to filter the network traffic prior to the network traffic being received by the virtual network.

10. The method of claim 8 wherein the firewall modules are configured to filter the network traffic based on custom traffic filters.

11. The method of claim 10 wherein the custom traffic filters include a rule to filter traffic based on a client ID of a client that owns a virtual machine.

12. The method of claim 10 wherein the custom traffic filters include a rule to filter traffic based on which virtual machine generated the traffic filter.

13. The method of claim 10 wherein the custom traffic filters include a rule to filter traffic based on a virtual network identifier.

14. The method of claim 10 wherein the custom traffic filters include a rule to filter traffic based on a virtual machine that is a recipient of the traffic.

15. A system comprising:

a physical server connected to a physical network and executing a virtual machine connected to a virtual network;

a firewall module executed by the virtual machine and configured to function as a firewall for the first virtual machine and to filter network traffic received by the physical server and addressed to the virtual server;

wherein the firewall module includes a superset of firewall rules shared by other firewalls operating on the physical and/or virtual network.