Zwall
Talk to an Engineer
Talk to an Engineer
Solutions: Virtualization

Apply packet policy on the virtualization host.

The Virtualization Agent discovers interfaces and KVM/libvirt VMs, then can attach XDP on ingress and TC on egress. Rules and blocks come from the Manager. This is the Zwall profile that is allowed to drop traffic. Other hypervisors are not described as shipping integrations.

Talk to an Engineer Read the Architecture
KVM and libvirt infrastructure

Packet policy belongs on the hypervisor host

If you run KVM/libvirt, you need host/interface/VM visibility and the ability to enforce IP/CIDR/port/protocol policy close to the datapath. Zwall's Virtualization Agent is that profile. It is not the Hosting Agent.

Per-guest firewalls do not see the host datapath. A conventional host firewall sits later than XDP. Zwall's Virtualization Agent maps libvirt VMs and host interfaces and can attach kernel programs on ingress and egress under Manager policy. This is host-level enforcement, not a guest agent inside every VM.

Architecture

Manager policy → Agent → maps → XDP/TC

Operators create and assign rules and blocks on the Manager. The Virtualization Agent authenticates, heartbeats, and synchronizes. It programs eBPF maps used by firewall XDP (ingress) and firewall_egress TC (egress). Telemetry and VM/interface inventory upload to the Manager for console views.

Manager Policy Virtualization Agent VM / Interface Map XDP / TC eBPF Programs Sync Attach Maps VMs Ingress Egress Events Upload Manager Policy Virtualization Agent VM / Interface Map XDP / TC eBPF Programs Sync Maps VMs Attach In Out Events
Packet-policy flow
Capabilities

What it does on the host

CapabilityWhat it means
Interface discoveryHost interfaces used for attach and inventory
VM mappingKVM/libvirt workloads visible to the Manager
XDP ingressEarly ingress inspection/enforcement
TC egressEgress qdisc path
Firewall/block syncManager objects become maps
Console viewsVirtualization, VM, and interface pages

Testing / non-enforcing modes exist so operators can inspect before they enforce. That is not a benchmark.

Attachment and cleanup are operator-visible facts of the Virtualization Agent. Certified kernel combinations are published on Supported Platforms when that table has Certified rows. See Reliability and Certification.

Privileges

This profile runs as root

Virtualization Agents load eBPF and require root (the Agent exits if it is not root, unless Hosting is enabled). Example capability set includes CAP_NET_ADMIN among others.

Do not describe a non-root Virtualization enforcement install as supported. Hosting uses a different privilege split (unprivileged Agent + privileged loader).

Comparison

Distinct from Hosting

Feature Virtualization Agent
Job Packet Enforcement
Packet Drop Yes (when configured by Manager policy)
VM Topology Host-level, maps libvirt VMs without guest agents
Available in Community Yes (with 3-Agent limit)
Available in Enterprise Yes (Licensed entitlements)

Virtualization is where assign-to-agent is intended. Hosting Agents cannot receive rules (the Manager returns HTTP 409).

Boundaries

Hypervisor boundary

Current virtualization support is KVM/libvirt. Other hypervisors are not shipping integrations.

Virtualization enforcement exists in Community (source, 3 Agents) and Enterprise (licensed). Hosting observation does not come along for free on Community.

Workflow

Evaluation Workflow

  1. 01 Deploy Zwall Manager (Community or Enterprise).
  2. 02 Deploy Virtualization Agent on a KVM host.
  3. 03 Observe VM and interface mapping in the console.
  4. 04 Assign test rules and verify XDP ingress or TC egress drops.
Docs

Virtualization Documentation

Frequently Asked Questions

Which hypervisors are documented?

KVM/libvirt only as a shipping integration.

Does Zwall replace my host firewall?

XDP can sit in front of netfilter. Validate on the target distribution. Not a certified replacement matrix.

Does this require a model?

No. Enforcement does not depend on AI.

Can I assign the same rule to a Hosting Agent?

No. Hosting Agents cannot receive rules (HTTP 409).

Is Virtualization in Community?

Yes, with a 3-Agent limit and source install. Hosting Agent is still Enterprise.

Does this run inside each VM?

No. The Agent runs on the virtualization host.

Ready to enforce policy on your KVM hosts?

Evaluate Zwall Community or talk to an engineer about Enterprise.

Talk to an Engineer
Read the Architecture
Explore Zwall Community (Limited to 3 Agents)