Application based network traffic management
Described herein are systems, methods, and software to enhance network traffic management for virtual machines. In one implementation, a host for a virtual machine may identify applications available for execution on the virtual machine from mounted application volumes and identify firewall rules for the applications. Once identified, the host may identify network traffic for the virtual machine, and forward or block the network traffic for the virtual machine based on the firewall rules.
1. A method of operating a hypervisor associated with a virtual machine to implement a firewall for the virtual machine, the method comprising
obtaining, from a virtual computing service, identifiers for one or more applications available for execution on the virtual machine from one or more mounted application volumes;
identifying firewall rules for the one or more applications;
identifying outbound network traffic from the virtual machine to a destination network address;
determining whether to permit the outbound network traffic based on the firewall rules; and
if permitted, forwarding the outbound network traffic to the destination network address.
2. The method of claim 1 wherein obtaining the identifiers for the one or more applications from the virtual computing service comprises obtaining the identifiers for the one or more applications from the virtual computing service in response to a user requesting a virtual computing session from the virtual computing service.
3. The method of claim 1 wherein the one or more mounted application volumes comprise volumes mounted based on a user allocated to the virtual machine by a virtual computing service.
4. The method of claim 3 wherein contents of the one or more mounted application volumes are overlaid in a file system for the virtual machine.
5. The method of claim 1 further comprising:
identifying inbound network traffic from an external source to the virtual machine;
determining whether to permit the inbound network traffic based on the firewall rules; and
if permitted, forward the inbound network traffic to the virtual machine.
6. The method of claim 1 wherein each firewall rule of the firewall rules for the one or more applications comprise at least ports for the virtual machine and at least one destination network address.
7. The method of claim 1 further comprising:
if unpermitted, blocking the outbound network traffic to the destination network address.
8. A computer apparatus comprising:
one or more computer readable storage media;
a processing system operatively coupled with the one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media to manage a firewall for a virtual machine that, when read and executed by the processing system, direct the processing system to:
in a hypervisor associated with a virtual machine, obtain, from a virtual computing service, identifiers for one or more applications available for execution on the virtual machine from one or more mounted application volumes;
identify firewall rules for the one or more applications;
identify outbound network traffic from the virtual machine to a destination network address;
determine whether to permit the outbound network traffic based on the firewall rules; and
if permitted, forwarding the outbound network traffic to the destination network address.
9. The computer apparatus of claim 8 wherein the program instructions to obtain the identifiers for the one or more applications from the virtual computing service direct the processing system to obtain the identifiers for the one or more applications from the virtual computing service in response to a user requesting a virtual computing session from the virtual computing service.
10. The computer apparatus of claim 8 wherein the one or more mounted application volumes comprise volumes mounted based on a user allocated to the virtual machine by a virtual computing service.
11. The computer apparatus of claim 10 wherein contents of the one or more mounted application volumes are overlaid in a file system for the virtual machine.
12. The computer apparatus of claim 8 wherein the program instructions further direct the processing system to:
identify inbound network traffic from an external source to the virtual machine;
determine whether to permit the inbound network traffic based on the firewall rules; and
if permitted, forward the inbound network traffic to the virtual machine.
13. The computer apparatus of claim 8 wherein each firewall rule of the firewall rules for the one or more applications comprise at least ports for the virtual machine and at least one destination network address.
14. The computer apparatus of claim 8 wherein the program instructions further direct the processing system to, if not permitted, block the outbound network traffic to the destination network address.
15. A system to implement a firewall for a virtual machine, the system comprising:
a virtual computing service configured to:
allocate the virtual machine to the end user from a plurality of virtual machines;
identify one or more applications associated with the end user;
initiate a volume attach process to attach at least one application volume with the one or more applications to the virtual machine;
transfer application identifiers to a hypervisor executing on a host for associated with the virtual machine:
the host configured to:
receive the application identifiers;
in the hypervisor, identify firewall rules to be applied against network traffic for the virtual machine based on the application identifiers;
identify outbound network traffic from the virtual machine to a destination network address;
determine whether to permit the outbound network traffic based on the firewall rules; and
if permitted, forward the outbound network traffic to the destination network address.
16. The system of claim 15 wherein the host is configured to, if unpermitted, block the outbound network traffic to the destination network address.
17. The system of claim 15 wherein the volume attach process comprises mounting the at least one application volume to the virtual machine, and overlaying contents of the at least one application volume in the virtual machine to make the one or more applications executable.
18. The system of claim 15 wherein the host is configured to:
identify inbound network traffic from an external source to the virtual machine;
determine whether to permit the inbound network traffic based on the firewall rules; and
if permitted, forward the inbound network traffic to the virtual machine.