0

What happens when you swap a modem and router out with a different modem and router?

Can you achieve full isolation by alternating between which network is plugged into the Internet line?

I am looking for full isolation of a honeypot computer while protecting a secure personal computer. I have a single DSL internet line.

It would look like this:

--Internet-- modem A - router A - secure computer

             modem B - router B - honeypot computer

If I change the cable back and forth between network A and network B, is there ANY way of the honeypot and/or an attacker influencing network A's modem, router, or secure computer?

By swapping modem and router:

Does your internet line IP address change?

Does it appear to the Internet as though you have an entirely different DSL Internet line running to your house?

Could an attacker, that has entered the honeypot on network B still see the network A after I unplug network B and connect network A back to the Internet?

Are there ports that an attacker could use on network A if said attacker has compromised the honeypot network?

  • How are you doing the 'alternating'? Changing the cable? – schroeder Feb 12 '17 at 21:58
  • Yes, just unplugging one modem and plugging in the other. – Smiith Feb 12 '17 at 22:01
  • So, your question is if you unplug the network cable, can someone still access the machine? And you're also asking if someone accesses the honeypot, and you disconnect them, if they can somehow hop from the now disconnected machine to another machine? – schroeder Feb 12 '17 at 22:03
  • Yes. And once the honeypot is disconnected can they still view the dsl Internet line's other modem/router (network A)? – Smiith Feb 12 '17 at 22:07
  • 2
    I'm concerned. These are really basic networking questions, and you're inviting attackers, who likely know way more than you, into your home. Are you prepared to burn that honeypot computer? Are you prepared to burn that router? I have run honeypots for years, and I can tell you that I'd never do what you are doing (though by using separate hardware, you're reducing your risks). – schroeder Feb 12 '17 at 22:19
0

I agree with @schroeder. This sounds like a really bad idea.

If you keep modem and computer A physically separated from modem and computer B and only ever have one or the other connected, never both at the same time, then they can't influence each other.

HOWEVER: If you are running a honeypot on your home IP, even if it changes when you unplug your modems, chances are that it won't change by much (you might be on a small ip pool, depending on your ISP). It's entirely possible that Honeypot and secure PC will be reachable via the same IP, though of course not at the same time. And even if not, they'll be on the same subnet. Attackers regularly scan subnets, and if they find a gold mine (well, a honeypot really), and then lose access to it because you unplug and plug in your secure modem/pc, then they might scan the subnet to find it again. Which means that you're drawing unwanted attention to a) lots of other customers of your ISP and b) your secure installation. Depending on how well you set up your honeypot, attackers may also manage to start sending spam or turn your honeypot into a botnet zombie, which would then get the IP added to all kinds of black lists.

If you really want to experiment with a honeypot, get an ec2 instance at amazon or a digital ocean instance (or any other cloud server). Check their terms of service to make sure they're ok with you drawing malicious traffic. This way you're not burning your ISP's dhcp pool.

I like this quote from a Patrick Rothfuss book: The protagonist is asked whether he knows the 3 basic rules of working in this very dangerous chemistry lab, and the third rule is: Eat elsewhere.

Or more bluntly: Don't **** in your own backyard.

  • If I were to use a cloud server, can attackers get through to my computer through my connection to the cloud server? Thank you. – Smiith Feb 12 '17 at 23:21
  • 1
    Thats very, very unlikely. But if you worry about it, use the setup you wanted to use for the honeypot to isolate the machine that connects to the cloud honeypot. Again, please consider what @schroeder said: If you are asking these questions, you might not be prepared to run a honeypot. – Pascal Feb 12 '17 at 23:22
  • Hmm, that definitely looks like an option for me. What should I look into for setting that up (recommended guides, tutorials, etc.)? Do you recommend any one cloud service over others? Thank you. – Smiith Feb 12 '17 at 23:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.