0

It is safe to make a DMZ to a VirtualBox VM that has pfSense installed with two network cards one on bridge and one on intnet. The DMZ would do this by indicating the ip of pfSense to the router.

Edit: with safe I mean if the other computers on the LAN, for example the physical computer are in danger of suffering an intrusion through virtual machines.

enter image description here

  • with safe I mean if the other computers on the LAN, for example the physical computer are in danger of suffering an intrusion through virtual machines. – rai Sep 29 '18 at 16:28
0

If I understand this correctly you forward any traffic originating from outside to a pfSense VM (192.168.1.3/10.0.0.3) which then filters it and forwards it to some inner VM (10.0.0.10). This means

  • An attacker which is able to heavily compromise the inner VM 10.0.0.10 or the pfSense VM 10.0.0.3 might be able to compromise the VM host through vulnerabilities in the virtualization layer. See these questions for more details on this.
  • Since pfSense is bridged into the internal network it is possible to access internal machines (VM host and others) from the pfSense VM and depending on the configuration of pfSense also from the VM behind pfSense (10.0.0.10). This way even an unprivileged user on the inner VM (10.0.0.10) might be able to attack the internal network (192.168.1/24) including the router. Explicit firewall rules on pfSense might be used to restrict which networks the inner VM can access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.