A host firewall agent sees a flow the border sees only encapsulated — what does that visibility cost when an intruder holds root in that guest?

## Three vantages, three structural blind spots This leaf is about ranking positions, not products. There are three places a packet filter can stand relative to a virtualised workload, and each is blind to something by construction rather than by misconfiguration. **The border or segment firewall** sees crossings. If the estate uses an overlay — guest traffic encapsulated between hypervisors — the packets on the physical path carry outer headers naming the two hosts and a tunnel port, with the guest's addresses and ports hidden inside the payload. A border rule can permit or deny *host-to-host tunnel traffic*, which is close to useless as a workload policy, and a flow record from that path proves only that bytes moved between two hypervisors. **The agent inside the guest** sits at the decapsulation point. Inbound, the hypervisor strips the outer header before the frame reaches the virtual NIC, so the guest's own filter sees the inner five-tuple. Outbound, it acts before encapsulation. It also has something no network device has: local context — which process opened the socket, under which user, listening on which port. That is why an agent can express a policy like "this service may reach the database and nothing else on this host may", which no purely network vantage can express. **A filter in the hypervisor's virtual switch** sees every flow to and from every guest on the host, including guest-to-guest traffic that never touches a wire, and it does so from outside the guest's operating system. What it structurally cannot see is the process or the user: to the virtual switch, a flow from a guest is a flow from a virtual port with a MAC and an IP. It cannot tell the application from a shell an intruder opened, because both look identical on the wire. ## The price attached to the agent's vantage The agent has the best view, and the reason it has the best view is exactly the reason it is fragile: it is running *inside* the thing you are trying to contain. Enumerate what an intruder with local administrative privilege can do to it: stop the service or kill the process; unload or bypass the kernel filtering path; insert a permit rule ahead of the deny; change the policy file and let the local cache serve it; block the agent's path to its management plane so it keeps enforcing a stale policy; or move to a guest where the agent was never installed in the first place. Nothing there requires a novel exploit. It is administration. The other half of the price is operational: an agent is a fleet. Every new guest needs it before it carries traffic, every image needs it baked in, every policy change fans out to thousands of endpoints, and each agent consumes a slice of the guest's CPU that the workload owner will eventually notice and question. ## The wrong answer this question aims at The confident wrong answer is that a host-based agent gives you microsegmentation, therefore the internal network is enforced, therefore an intruder inside a guest is contained. Two things are wrong with it. First, an intruder who owns the guest owns the enforcement point for that guest's own traffic — the agent constrains the workload, not the person who replaced it. Second, containment is a property of the *pair*: if the sender's agent is compromised, the receiver's agent is still an independent decision point, and a design that relies on only one side of the conversation has one control, not two. The useful mental model is that an agent enforces reliably against everything except an adversary who has already reached the privilege level the agent runs at — and that is precisely the adversary you deployed it for. ## Putting it together A defensible answer ranks the vantages against a specific intrusion and states the residual for each. Against an intruder with root in one guest: the agent in that guest is compromised and its policy is advisory; the agent in the *neighbouring* guest still denies inbound and is worth having; a hypervisor filter is outside the intruder's reach and denies the pivot but cannot tell you which process attempted it; the border sees nothing at all if the flow stays inside the host. That ranking — not a feature list — is what the question is testing.