Looking for hints on KVM in DMZ on server

[bastibasti]

Hi,

I am currently running a small webserver on a KVM on my gentoo server. It uses bridged networking, so the webserver (kvm-guest) has a local ip like any other client on the LAN.

Is it possible, to configure it somehow, that the KVM Guest has a kind of DMZ? so a theoretical intruder it is not able to access anything on the LAN? So basically I would port forward the 443 to the KVM HOST and somehow forward it to the KVM GUEST as the only networking path for the guest (web server)?

Any brainstorming ideas or a push into the right direction would be very welcome... I want to prevent building another server as standalone firewall, wasting more energy etc.

[Hu]

You could switch to NAT-based networking, at which point this is easy. I think you could do it with bridging and the right iptables setup, but that is a bit more complicated, in my opinion.