I'm planning to run a Honeypot with the following network setup:
In order to avoid the honeypot coming in direct contact with my Internal network, I put it behind a firewall configured on a Linux VM with iptables.
There are the rules:
iptables -P FORWARD DROP
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-destination 10.0.0.5
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -d 10.0.0.5 -m state --state NEW -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Running a port scan on GRC Shields Up successfully shows the relevant ports to be open. And accessing
netstat -antp
Shows no services running on the Linux VM. In case this VM is attacked.
Are there any holes or misconfigurations in this setup? That can lead to the honeypot coming in contact with the 192.168.1.0/24 network?