1

This is a follow up to the question I asked yesterday.

According to the only answer I got, running a local Apache server used for development while simultaneously being connected to a commercial VPN provider is insecure, even though I configured Apache to only accept connections from 127.0.0.1:80. So the workaround I came up with is that I will set up a virtual machine that will be disconnected from the Internet (i.e. with disabled network adapter in VirtualBox) and run my server there, and do my VPN browsing in the host OS.

I believe this would prevent the server from being reachable any other way but by my computer, is that true? Is this a good idea?

|improve this question
  • So you configure your VM that the server can not be accessed from outside the VM, including that it can not be accessed from the host machine (i.e. no network adapter for this VM)? – Steffen Ullrich Jan 15 '17 at 17:05
  • Yes. But what do you mean by configuring? It's just a matter of unchecking a checkbox called "Enable network adapter" in VirtualBox, right? The host won't have Apache installed or any other web server, only the VM will but since it will have network adapter disabled I assume there will be no way that any other computer connects to it, it should only be possible to access this server from that VM. The fact that the host OS will be connected to a VPN won't matter, right? Will that be secure? – user136370 Jan 15 '17 at 17:44
  • If there is no network adapted in the VM it should be secure enough. Of course in theory the host could be infected which then can affect the VM image too since it can be modified from the host. But if the host is affected you have lost anyway. – Steffen Ullrich Jan 15 '17 at 17:50
  • Thanks. By the way, if the VPN I use doesn't seem to enable port forwarding on port 80 by default and it has to be manually enabled, then wouldn't that also be a protection by making the server unreachable to hackers in the first place? Wouldn't it be equal to being behind a home router that doesn't forward port 80 thus making any local server running on that port unreachable? – user136370 Jan 15 '17 at 18:10
  • Different question but: while the server can not be reached directly from outside one might use the browser on the host as a trampoline since this browser can reach both the internet and the server inside the VM. See also Why would a modern browser allow internal resources to be loaded from an external page. – Steffen Ullrich Jan 15 '17 at 19:16
1

The answer to your previous question was wrong. Running a web server accessible only at 127.0.0.1:80 is secure in that context, unless you are forwarding packets from the VPN interface to loopback.

To answer your current question: Yes, the web server would be unreachable outside of your VM, but it's not needed.

Personally, I would do my browsing via the VPN inside of a VM to potentially limit any client side exploits (browser, etc)

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.