I have a virtual machine with Windows 10 as its guest and Ubuntu 14.04 as its host. My router has its SPI firewall enabled, with only ports 22 and 80 being forwarded to the Ubuntu host. The Windows guest has a manual IP set outside the DHCP range of the router, and its gateway setting is left blank. That allows its files to be accessed via SMB on the local network, but it has no route to the Internet. I don't have any anti-virus software on the VM, and it doesn't receive any software updates. Its only purpose is to serve files in conjunction with software that only runs on Windows. I figured that it's secure because it doesn't have direct access to the outside world.

Should I consider the VM to be safe and secure? Should I take any steps to make it more secure?

Edit: I should also note that the guest has a bridged network adapter, meaning it has a real IP address on the LAN, like every other physical machine.

  • 3
    If you don't want the guest system to have internet access, configure the host firewall to deny the corresponding traffic. Don't rely on the guest system's network configuration to do that for you, regardless of the scenario. – Potaito Sep 20 '16 at 19:46
  • Could you explain why? Also, how is the host firewall relevant to the guest's network traffic? I don't know what I would block on the host firewall. – aswine Sep 20 '16 at 20:29
  • Firewalls are made to allow and block specific traffic. The windows network configuration is made to allow applications to connect to a network by providing routing, DNS etc. It is not designed to prevent applications from using a different configuration. And since you are worried about security, this is an important difference. You could have software on the guest capable of finding its own routes, thus bypassing the settings you have foreseen. – Potaito Sep 21 '16 at 9:02
  • The firewall on the host system is relevant since the host routes the traffic from the virtual machine (technically its virtual network adapter) to the host's physical network adapter. Thus you can prevent certain protocols or ports on the guest to be reachable by blocking them on the host level. This way your security would also stay in place in a case where someone has gained full control over your guest system (assuming the virtualization cannot be escaped from inside the guest system). – Potaito Sep 21 '16 at 9:04
  • There is in interesting underlying question here: what is more secure for a Windows system, having it not connected to internet but with no patches or let it connect and pass all patches. I think it has already been discussed here but could not find the question. – Serge Ballesta Nov 20 '16 at 16:08

"Should I consider the VM to be safe and secure?" - The VM is actually the guest not the host. In the case you've outlined, the guest VM cannot be considered "safe and secure". The reason is that it is accessible from the LAN but doesn't have anti-virus and isn't being patched. Any malware that infects another machine on the LAN is very likely to gain access to the VM.

The host is a different issue, if you have an insecure guest with access to the host then it is possible that the host won't be secure either. If there is no route from guest to host that part should be OK but obviously the host should be running IPTABLES and have anti-virus running and be locked down in the normal ways.

"Should I take any steps to make it more secure?" - Yes, you need to make sure that the guest is getting regular updates and that it is running anti-virus with updates. It is possible, but complex, to do this without a direct Internet connection but really not worth the effort.


It depends on a lot of factors:

  • Does the ubuntu run a web server? If yes, is there any vulnerabilities?
  • Does the smb share is accessible from the web?
  • Are the passwords good for your ssh?
  • What are the app running on Windows?

More info would be needed. By the way, you should use 443 instead of 80 (https instead of http). If you have any web login, somebody could sniff your traffic and get your credentials. Then, it would not be secure enought :/

In all case, I think an attacker would need to compromise your host first because he is the only one available from the internet.

  • 1) Yes, but it's only apache. I only use it for the occasional file share. There's no database or anything. 2) No. That port isn't being forwarded by the router. 3) Yes. 4) Quickbooks. – aswine Sep 20 '16 at 20:31
  • Also, I don't think there's a reason to use https in my case as there's no web login. – aswine Sep 20 '16 at 20:33
  • @aswine "I don't think there's a reason to use https in my case as there's no web login." What is the benefit of forcing a site to load over SSL (HTTPS)? – a CVn Sep 21 '16 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.