Opinion on firewall virtualization with Xen

["Abel Martín" <abel.martin.ruiz@gmail.com>]

Hi,

I'd like to hear your opinion on xenifying several Debian boxes that
run iptables to offer independent and isolated configuration for
different networks. Would it be mad setting up a dom0 with a large
number of domUs inside it to provide this?

I'm actually working on this combined with high availability using
heartbeat for sharing gateway IPs, and bonding or STP to provide
network failure tolerance. The idea is to have two dom0s on different
servers with a high availability link (via bonding or STP) and several
paired domUs in both dom0s sharing a common resource which would be an
IP address (via heartbeat).

Flaming allowed ;)