[Qemu-devel] suitability for extension encapsulation in firewall

[Eric S. Johansson]

I'm looking for a way to encapsulate applications on a firewall (IPCop).  My 
line of reasoning is an encapsulated extension environment would help protect 
the integrity of the firewall and give users greater latitude in creating 
extension applications.  What I would like to do is install qemu as a "virtual 
server" residing on the DMZ/Orange network with its interface fully controlled 
by the Orange network firewall rules.  I've run qemu and am slightly familiar 
with the tun/tap setup but I don't know its relationship to IP tables.  Does is 
sit outside the rules like the raw device or inside?

on a related topic, is it possible to trigger a shutdown command (or even a 
reboot) and detect when the virtual machine has stopped running or had its 
hardware get the reboot signal so I can shut things down cleanly?