I have a virtualised infrastructure here, with separated networks (some physically, some just by VLAN) for iSCSI traffic, VMware management traffic, production traffic, etc.

The recommendations are of course to not allow access from the LAN to the iSCSI network for example, for obvious security and performance reasons, and same between DMZ/LAN, etc.

The problem I have is that in reality, some services do need access across the networks from time to time:

• System monitoring server needs to see the ESX hosts and the SAN for SNMP
• VSphere guest console access needs direct access to the ESX host the VM is running on
• VMware Converter wants access to the ESX host the VM will be created on
• The SAN email notification system wants access to our mail server

Rather than wildly opening up the entire network, I'd like to place a firewall spanning these networks, so I can allow just the access required

For example:

• SAN > SMTP Server for email
• Management > SAN for monitoring via SNMP
• Management > ESX for monitoring via SNMP
• Target Server > ESX for VMConverter

Can someone recommend a free firewall that will allow this kind of thing without too much low-level tinkering of config files?

I've used products such as IPcop before, and it seems to be possible to achieve this using that product if I re-purpose their ideas of "WAN", "WLAN" (the red/green/orange/blue interfaces), but was wondering if there were any other accepted products for this sort of thing.

Thanks.