VMware ESXi – Providing Guest VM Internet Access Through Host with One Adapter

Your current configuration is fine. THe private switch data is only accessible by any of the machines attached to it. You have a limited scope of access so you should be safe. If you were do do anything, you could possibly add a second NIC to PF sense to a separate private vSwitch to basically have a DMZ but its not necessary and a bit excessive. Your milage may vary..

It's not the best solution, of course - ideally you would have a separate VM host for DMZ guests. If you do choose to go this way though, some points you should take into account:

• The obvious one first: someone can use an exploit to escape the VM jail and so compromise your LAN hosts from the DMZ. So you should really keep up with patches both on DMZ guests and host, and then hope for the best.

• Mistakes in the configuration have serious consequences. Think, for example, of the possibility you or some else assigns NICs both on the DMZ and the LAN to some host. Now your DMZ and your LAN are the same thing. Of course you can prevent this by enforcing procedures and just being competent, but you see how you could say you end up with a more fragile environment.

That said, it's still better than not having a DMZ at all so it can be a good stop-gap solution if you can't use a separate host right now. Just keep in mind that it's not as safe as having your DMZ guests on a separate host and real network.