A hosting company provides inexpensive guest virtual machines to low-margin customers. Customers manage their own guest virtual machines. Some customers want basic guarantees of logical separation…

Allowing only customer self-management of the hypervisor-based firewall satisfies the self-configuration group but does not fulfill the requirement for a hosting-company-managed separation option for customers who want it provided as a service.

A hypervisor-based firewall operates at the virtualization layer, providing logical tenant isolation without costly dedicated hardware, which suits the low-margin hosting model. Having the hosting company manage the firewall by default satisfies customers who want separation delivered as a value-added service, while still allowing customers who require configuration control to manage their own rule sets - meeting both distinct requirements within a single flexible architecture.

Physical firewalls add significant per-customer hardware cost that is incompatible with the inexpensive, low-margin hosting model, and they do not provide the flexible managed-versus-self-managed model the question requires.

Host-based firewalls installed inside each guest VM protect only at the OS level and do not provide true hypervisor-layer logical separation between tenants, failing to meet the multi-tenant isolation requirement.