Is NFS over NAT secure?

[cam_macdonell]

Hi,

I'm curious if VMs on a NAT will be able to spoof being the host itself and therefore mount any NFS exports that the host can mount. My thought comes from the fact that the NFS server can't distinguish the guest traffic from the host traffic.

Thanks,

Cam

[purduecjs]

Service Console and VM traffic should be on different networks ... additionally, the source IPs for the vm and the ESX host should be quite different so there is no identifiable security risk that I can see as long as 1) your SC and VM do not share the same network, and 2) your NFS exports are defined correctly so as to only allow those hosts/IP's that need access.

Hope that helps!

Cameron J. Smith

System Administrator, Purdue University

[purduecjs]

You are correct in your assumptions. I would suggest segregating networks (using multiple external IP's) if possible and only NAT on a secondary IP, one that you would reserve for VM traffic. The only other alternative that I can think of would be to expose each VM to the network with its own IP.

Cameron J. Smith

System Administrator, Purdue University