Network design opinions involving vms?

So first off I am not sure if this is the correct place to post this.

Currently I have a setup that looks like this:



I am wanting to replace the the firewall with a computer firewall, that computer will host the squid vm and the vm then pushes out to the router etc.



I am trying for a transparent proxy like I currently have set up. I don't want squid exposed to the internet directly which is why I am aiming to have it on a vm instead of as a service on the firewall


So I am wondering what the best way to achieve this is. I was thinking that I should use something like a host-only adapter so that when the internal traffic hits squid, it can push the traffic to its host-only adapter which would then be handled by the firewall and out it goes

However I am having a hard time getting my head around this setup conceptually I dont know if this would work and I don't particularly want to run a double nat unless I have to

Any opinions are welcome!

by host only, you mean a dedicated nic? thats what i would do, then push it out via the second network.


however, would it be best to have your Squid alongside your firewall (ie on it, running chacing, etc...) ?

well by putting squid on the firewall its an extra service that is potentially exposed to the outside world. Best practices says that you should limit services as best as possible

Stratus_ss said:

well by putting squid on the firewall its an extra service that is potentially exposed to the outside world. Best practices says that you should limit services as best as possible

Click to expand...

You are correct that best practices call for separation of services. However in my home network I choose to ignore that rule since I have limited resources and space. I would recommend running your firewall, NAT and Proxy all on the same box. As long as you have sane configs, keep your OS and packages updated, and only have services listening on the interfaces needed you should be safe.

i would say as long as you're adding a second (or third for 2 squid interfaces) nic's then you could instead use a separate VM for your FW and other for Squid, you would achieve the same result.