Firewall for a Virtual Network and Related Techniques

• US 20140280911A1
• Filed: 03/07/2014
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: ProfitBricks GmbH (ProfitBricks, Inc.)
• Original Assignee: ProfitBricks GmbH (ProfitBricks, Inc.)
• Inventors: Wood, Conrad N., Weiss, Achim
• Granted Patent: US 9,888,055 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 49/00 Packet switching elements
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30

Abstract

A system for filtering traffic in virtual networks includes a first virtual machine executed by a first physical server connected to a physical network and a second virtual machine executed by a second physical server connected to the physical network. The first and second virtual machines are connected to a same virtual network. A first firewall module is executed by the first physical server and a second firewall module is executed by the second physical server. The firewall modules are configured to filter network traffic received by the physical servers and addressed to the virtual servers.

Claims

1. A system comprising:

a first virtual machine executed by a first physical server connected to a physical network;

a second virtual machine executed by a second physical server connected to the physical network, wherein the first and second virtual machines are connected to a same virtual network;

a first firewall module executed by the first physical server and a second firewall module executed by the second physical server, the firewall modules configured to filter network traffic received by the physical servers and addressed to the virtual servers.

2. The system of claim 1 wherein the firewall modules are configured to filter the network traffic prior to the network traffic being received by the virtual network.

3. The system of claim 1 wherein the firewall modules are executed by a core processor of one or more virtual machines.

4. The system of claim 1 wherein the firewall modules include a superset of firewall rules from multiple firewalls to eliminate a need for a cascaded firewall scheme.

5. The system of claim 1 wherein the firewall modules are configured to filter the network traffic based on custom traffic filters.

6. The system of claim 5 wherein the custom traffic filters include a rule to filter traffic based on a client ID of a client that owns a virtual machine.

7. The system of claim 5 wherein the custom traffic filters include a rule to filter traffic based on which virtual machine generated the traffic filter.

8. The system of claim 5 wherein the custom traffic filters include a rule to filter traffic based on a virtual network identifier.

9. The system of claim 5 wherein the custom traffic filters include a rule to filter traffic based on a virtual machine that is a recipient of the traffic.

10. A method comprising:

executing a first virtual machine by a first physical server connected to a physical network;

executing a second virtual machine by a second physical server connected to the physical network, wherein the first and second virtual machines are connected to a same virtual network;

executing a first firewall module by the first physical server and a second firewall module by the second physical server, the firewall modules configured to filter network traffic received by the physical servers and addressed to the virtual servers.

11. The method of claim 10 wherein the firewall modules are configured to filter the network traffic prior to the network traffic being received by the virtual network.

12. The method of claim 10 wherein the firewall modules are executed by a core processor of one or more virtual machines.

13. The method of claim 10 wherein the firewall modules include a superset of firewall rules from multiple firewalls to eliminate a need for a cascaded firewall scheme.

14. The method of claim 10 wherein the firewall modules are configured to filter the network traffic based on custom traffic filters.

15. The method of claim 14 wherein the custom traffic filters include a rule to filter traffic based on a client ID of a client that owns a virtual machine.

16. The method of claim 14 wherein the custom traffic filters include a rule to filter traffic based on which virtual machine generated the traffic filter.

17. The method of claim 14 wherein the custom traffic filters include a rule to filter traffic based on a virtual network identifier.

18. The method of claim 14 wherein the custom traffic filters include a rule to filter traffic based on a virtual machine that is a recipient of the traffic.

19. A system comprising:

a virtual machine connected to a virtual network and executed by a physical server connected to a physical network;

a firewall module executed by the first physical server and configured to filter network traffic received by the physical server and addressed to the virtual server.