Let the diagram below be a representation of a LAN.
- let R be the interface between the LAN and the internet.
- H be host connected to the LAN.
- F be a firewall implemented using a virtual machine controlled by H.
- V be a virtual machine controlled by H.
- F is also the interface between the LAN and V.
- F also blocks all traffic from V destined for H.

 |     |
 F     H

- H uses V for all insecure/casual internet activity
- H does all secure/private activity by itself (ie. banking)

How secure is this?

I know the user will be largely responsible for most breaches, like reusing passwords, or pulling files out of V, or using a VM that V can escape; but, aside from user error, is H safer?

Since V will be doing most of the insecure stuff, I can only see attackers targetting V because V is the only one that's out there that they can identify. Any viruses/attacks from V would be blocked completely by F if F is set to block all traffic on the LAN between them too. So, yeah, come break this setup.

I want to know if separating insecure activity with secure ones can make a host safer.

--- edit

So, probing the network will unveil H. In terms of V getting infected, though, can any of its infections reach H?

And yeah, H should be behind a firewall of its own.


No, I think V is safer than H. For H you are going for the security-through-obscurity approach, which is always discouraged.

This is because, in my opinion, your assumption that attackers targetting V will not come across H is faulty. For example, most of the latest worms don't only attack a single target system but also try to discover the target networks' topology and neighbouring hosts. So in my opinion it will be better if you take H behind the firewall too and don't expose it directly to the internet.

| improve this answer | |
  • I thought worms had to infect first before they can hunt for hosts on the same network. If so, worm activity inside V cannot pass through F. In any case, yes, H needs its own means of protecting itself as well. – user2738698 Mar 21 '14 at 17:16
  • No, thats not necessary. For example most modern worms will never just attack a single IP address but will port scan all IP addresses in a target subnet. – xkcd Mar 21 '14 at 17:32
  • Kk, so when V does something insecure, V is also putting the entire LAN in danger. – user2738698 Mar 21 '14 at 17:36
  • Exactly, because for worms its not a big difference to scan 1 machine or 255 machines. In fact, they will be even more agressive and scan 512 machines, what do they have to lose :) – xkcd Mar 21 '14 at 17:48
- H uses V for all insecure/casual internet activity
- H does all secure/private activity by itself (ie. banking)

You may have this thought/theory inverted. On a flat line it looks like this:

Host (does all secure/private activity) --> router --> internet

There is no firewall mention here. Where if it were me, I would do:

Host --> proxy server (locked down w/IPS, AV, etc) --> router --> internet

Then you state:

Host --> Virtual (casual) --> gets firewalled here? --> back to host --> or gets firewalled here? --> router --> Internet

If V is not important, why bother wasting time and resources doing any filtering?

If you're that concerned about say banking, why not just use a bootable Linux cd whenever you're going to do something you perceive as mission critical. OR... Just throw up a proxy server running IDS, IPS, say Squid, and a firewall. I don't get your logic.


I think that you are going a bit overboard here. If you had a strong proxy, you wouldn't need to worry about a lot of attacks, since you would be able to strip data as it comes in, before it's even run in your network.

For example, with Squid used as a web proxy, you could do re-writes to remove java, javascripts, iframes, flash, etc., this greatly reduces the web attack vector. You can use YARA to further minimize as well. Which brings up another question / comment. If V is NOT that important, and used for casual things, why not just use a bootable version of Linux/BSD for THAT machine? That in itself removes a LARGE attack surface.

| improve this answer | |
  • F means to filter traffic from V to H, so that V can't directly target H if V is compromised. – user2738698 Mar 21 '14 at 17:50
  • "remove js, iframes, flash..." : very secure, but the set of working sites will be... small. – Jeff K Feb 24 '17 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.