Install KVM on a live Centos7 server?

Centos7

I have a server which is already set up, being used as a web server mainly.
The original plan was to set it up as a KVM host but I didn't have time so simply set up the web sites and off it went.

Now I need to get back to this and figure out if I can still add KVM on it but everything I read talks about first using iptables instead of firewalld and how iptables has to be set up to allow the virtual routing.  

I don't want to mess with the server because it's running live sites but I still need to get it to host vms.

It's just a server so I'm assuming I can still turn it into a vm host but need to know the steps so I don't take it down while I'm doing the changes.

Last part of the question is... can ESXi vms be converted to be hosted on Centos7 KVM? Most of them which are important are all Centos based, a new Debian vms.
projectsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Zephyr ICTCloud ArchitectCommented:
The reason you read a lot about using iptables vs firewalld is because it can be difficult to use firewalld with KVM. Now that being said, technically it's possible to convert the host to a KVM host, but not without interruption or downtime because you need to do some work on the network settings for starters

If this were a lab situation I'd say go for it, but on a production system that needs to stay live...

For the last part, yes you can convert vmdk files, the disks from the VMware VMs, with qemu-img.
0
projectsAuthor Commented:
The reason I would prefer using firewalld is because at some point, iptables will no longer be supported. If that is years away, then it's not an issue.

For the live server part, only one is critical so I could do it at night. How long could the network change take anyhow, moments?
0
Zephyr ICTCloud ArchitectCommented:
Sorry for the late answer, couldn't keep my eyes open last night.

Firewalld still uses iptables underneath, so don't expect iptables to go anywhere anytime soon, so if you feel more comfortable with iptables there's no reason to switch to firewalld except for learning to use it maybe.

The thing is, you're going to create a bridge of your server's nic as wel as enable ip forwarding, this is not such a big deal if your server is on the LAN, but can be a security risk if your server is directly connected to the Internet. You have to make sure that your iptables are properly configured.

Regarding the bridge, you will only do that if you want your VM's to be available on the LAN, if you want them to stay into their own private network (92.168.122.0) then there's no need for the bridge.
But,, if you're going to use a bridge, how will this impact your webserver, which is reachable from the Internet I assume? Do you have an extra nic maybe?

It might take a few minutes, half an hour maybe, to configure everything for the networking, not counting the iptables config.
0
projectsAuthor Commented:
This particular server is in a data center on a public IP.
It has two NICs, one which is on the LAN to access the server via IP KVM in case of problems and the other is for the public IP along with additional aliased public IPs.

>Regarding the bridge, you will only do that if you want your VM's to be available on the LAN,
>if you want them to stay into their own private network (92.168.122.0) then there's no need
>for the bridge.

I'm a little confused about this comment. If the vms have two virtual NICs, could they not talk to each other anyhow since they are all on the same host?

In reality, there isn't much need for the vms to communicate together using LAN, they could simply use their WAN IPs if really needed.
However, the part that is still not clear to me on this is how it all comes together.

Does the host Centos7 server become the firewall for the vms or do the vms exist as stand alone, needing public IPs no matter?

I thought I could create as many vms as I want (available resources of course) on the host, then public connections hit the host, which in turn uses NAT to reach the vms. Basically, in the same way as any network with a firewall in front of the LAN.
0
Zephyr ICTCloud ArchitectCommented:
No, maybe you're mixing things up.

The host would get the bridge if you want your VM's to talk to possible other servers and/or services on your LAN, but you don't have a LAN so that part doesn't matter, seems like you don't need a bridge.

Default install will create a private network usually 192.168.122.0/24, so all VM's using this private network, connected to this private network will be able to talk with each other and the host.

Does the host Centos7 server become the firewall for the vms or do the vms exist as stand alone, needing public IPs no matter?

There's the possibility to create another private network that you could use as a DMZ, or, another possibility use the iptables to forward incoming requests to the correct VM. In any case, the host will need to be a firewall because its physical nic is connected to the Internet if I understand your setup correctly.

I thought I could create as many vms as I want (available resources of course) on the host, then public connections hit the host, which in turn uses NAT to reach the vms. Basically, in the same way as any network with a firewall in front of the LAN.


Yes, like I explained above, that will be the case in your situation. If you would want the VM's to be connected to the physical nic which is used for Internet, you could create a bridge on that interface and create a separate private network using that interface... But it might be better to just use forwarding.

So, to top off... The KVM host will be configured without a bridged nic, just the standard private network will be created which can be used to let the VMs talk with each other if needed and the host.

By the way, a very nice document for installing/configuring KVM is to be found here
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.