How can I reliably check in automatized way that there is no Internet access from the Windows (Server 2012 and later) instance? I mean all possible protocols and programs.

  • Write a Python script to ping foreign addresses and note if there is a response? – whoami Aug 11 '17 at 16:24
  • @amirootyet It's just check that specific resource is available or not for ICMP. – SerG Aug 11 '17 at 16:33
  • 1
    Make a curl get request to any website. – Digital fire Aug 11 '17 at 16:53
  • @DigitalFire It's just check for availability of the specific website. – SerG Aug 14 '17 at 11:13

You still need internal network access, correct? There are lots of ways to be confident the system has no general Internet access but no way to PROVE it. (If it is networked it can be tunneled, etc.) You could programatically verify there is no default route for IPv4 or IPv6 - Only routes for your internal networks. It's basic but easy to script.

If the problem you are trying to solve is making sure the network firewall admins did not open up outbound Internet access from your DMZ, you will need to do active testing against an outside (AWS or other hosted machine) with a combo if scripted NMAP blasting out from the machine you are testing and a deny all firewall on the AWS/hosted sensor machine with logging. You will need to know what source IP the machine being tested is coming from. Since it should have no Internet access, you can't just script in a "canihazip" check.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.