8

I'm planning to run a Honeypot with the following network setup:

enter image description here

In order to avoid the honeypot coming in direct contact with my Internal network, I put it behind a firewall configured on a Linux VM with iptables.

There are the rules:

iptables -P FORWARD DROP

iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-destination 10.0.0.5

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i eth0 -o eth1 -d 10.0.0.5 -m state --state NEW -j ACCEPT

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Running a port scan on GRC Shields Up successfully shows the relevant ports to be open. And accessing 

netstat -antp

Shows no services running on the Linux VM. In case this VM is attacked.

Are there any holes or misconfigurations in this setup? That can lead to the honeypot coming in contact with the 192.168.1.0/24 network?

|improve this question
4

As long as your router has its access rules to not allow any connections from your honeypot to the rest of your network then that should work out fine. Only allow connections from the management network or IP addresses to the linux VM host and honeypot, that way if either is hacked it won't be able to attack your network directly.

Make sure there's no information on the linux VM host or the honeypot that can be used to attack your network. Don't use the same usernames or passwords, and don't store any information on them at all.

Also, hopefully you've given us fake IP address ranges, otherwise you're enumerated the IP Address ranges you use on your network in which case I'd change them.

|improve this answer
  • The honeypot is not able to initiate outgoing connections, so I guess I'm good? and yes, those IP ranges are just an example. I've just got HoneyBOT running for now, and judging by the amount of hits it has recorded, I feel everyone should run a honeypot just as decoy. – Kedar Dec 6 '12 at 14:30
  • You can't rely on iptables in this case, if your system was rooted the router is the only defense you have, so make sure that there are rules there to protect the rest of your network. – GdD Dec 6 '12 at 14:49
  • I'm not sure I advocate using a honeypot as a decoy, IMHO you're more likely to draw attention to yourself that way. – GdD Dec 6 '12 at 14:50
3

GdD makes some good points about routing and access rules, so I won't regurgitate those. I will, however, remind you that you're inviting nare-do-wells into a segment of your network and the only separation between church and state with your setup is one router, which I assume is a generic consumer grade device. It's very likely that this perimeter device will come under attack at some point and if it goes down there doesn't appear to be any network defense. At the very ABSOLUTE MINIMUM I would recommend a separate firewall between your personal network and the router. If you can put a switch and there and isolate the traffic, even better.

|improve this answer
  • The router has a firewall in-built if that's what you are saying. But wouldn't the risk that you mentioned(of the perimeter device failing) be the same irrespective of running a honeypot? – Kedar Dec 6 '12 at 14:39
  • 1
    Yes and no. The risk is the same but the likelihood of ocurance increases from the nature of the activities that your honeypot may attract. Having one embedded firewall, in my opinion, is insufficient for your intent. Check out the honepot research paper (roottruth.blogspot.com/p/honeypot-research-paper.html) for a highlevel overview. I would recommend: Internet > Router > Firewall > Switch > [Honeypot Subnet w/ devices] and Internet > Router > Firewall > Switch > Firewall > [personal subnet w/ devices] Even this setup can be done fairly cheaply, and it's just one of many options. – grauwulf Dec 6 '12 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.