Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My setup:

- Main Box (connected to network)
  - VM1 : Linux
  - VM2 : Windows 7

Both the VMs are running off VM Player and using Bridged: connected directly to the physical network and replicating the physical network state. The user will connect to the Windows 7 box via a remote application like LogMeIn then have access to the Linux box as well via the Windows box to development testing.

This however would in turn give them direct access to my personal inside network as well if I am right. Is there a way to set this up and prevent that?

share|improve this question
    
What are you testing? Is this a web application? –  Rook Dec 4 '12 at 20:40
    
script development like python/perl/shell. Nothing crazy. However, the only thing that would be a bother is allowing someone in to a VM on the local network which gives them potential access to several other systems. –  Travis Thompson Dec 4 '12 at 20:47
1  
So shell only, not a webapp. Why do you need a vm or multiple machines? This is just going to make it more difficult to use a debugger. –  Rook Dec 4 '12 at 20:51
    
This essentially sounds like a networking problem. You can just separate your 'exposed' chunk into a different subnet (some home routers can support two lan subnets), and firewall the two. –  lynks Dec 4 '12 at 21:25
    
So creating a new subnet would be the ideal choice of action and place the VMs on that subnet and ensure they can't edit the network settings? –  Travis Thompson Dec 4 '12 at 21:37
add comment

2 Answers

up vote 0 down vote accepted

If we treat this like a networking problem, one solution could be as follows;

    internet
       |
   adsl_router
       |
    -------------------------------
    |              |              |  
firewall      dirty_host_a   dirty_host_b
    |
    |
    --------------------------------------
    |                  |                 |
clean_host_a      clean_host_b      clean_host_c

In order for your clean network to remain safe;

  • Forward whatever ports you like on the router nat to your dirty hosts.
  • Configure your firewall to disallow all inbound connections.
  • Configure your firewall to only allow administration from the LAN side.

The 'firewall' node could be an actual hardware firewall, like a netgear FVS338, or a linux machine with two network interfaces, coupled with a switch and running iptables. Whatever you have lying around.

share|improve this answer
    
Yea, I do have the FVS338. Currently has a Switch and Wireless router plugged right into it. So this option could work. –  Travis Thompson Dec 4 '12 at 23:10
add comment

Change the vmplayer networking type to NAT, Firewall on the virtual server to prevent outgoing external connections from the VMs, except to LogMeIn and the other vm.

I, personally, like the VirtualBox networking better. 2 nics on the Win7 vm, one NATted, the other connected to an internal virtual network. 1 nic on the Linux vm connected to the internal virtual network. Firewall on the virtual server to prevent outgoing external connections (Except to LogMeIn).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.