Will separating internet activity and offline activity secure a host?

Question

Let the diagram below be a representation of a LAN.
- let R be the interface between the LAN and the internet.
- H be host connected to the LAN.
- F be a firewall implemented using a virtual machine controlled by H.
- V be a virtual machine controlled by H.
- F is also the interface between the LAN and V.
- F also blocks all traffic from V destined for H.

    R
    |
 +--+--+
 |     |
 F     H
 |
 V

Consider:
- H uses V for all insecure/casual internet activity
- H does all secure/private activity by itself (ie. banking)

How secure is this?

I know the user will be largely responsible for most breaches, like reusing passwords, or pulling files out of V, or using a VM that V can escape; but, aside from user error, is H safer?

Since V will be doing most of the insecure stuff, I can only see attackers targetting V because V is the only one that's out there that they can identify. Any viruses/attacks from V would be blocked completely by F if F is set to block all traffic on the LAN between them too. So, yeah, come break this setup.

I want to know if separating insecure activity with secure ones can make a host safer.

--- edit

So, probing the network will unveil H. In terms of V getting infected, though, can any of its infections reach H?

And yeah, H should be behind a firewall of its own.

Answer 1

No, I think V is safer than H. For H you are going for the security-through-obscurity approach, which is always discouraged.

This is because, in my opinion, your assumption that attackers targetting V will not come across H is faulty. For example, most of the latest worms don't only attack a single target system but also try to discover the target networks' topology and neighbouring hosts. So in my opinion it will be better if you take H behind the firewall too and don't expose it directly to the internet.

Answer 2

Consider:
- H uses V for all insecure/casual internet activity
- H does all secure/private activity by itself (ie. banking)

You may have this thought/theory inverted. On a flat line it looks like this:

Host (does all secure/private activity) --> router --> internet

There is no firewall mention here. Where if it were me, I would do:

Host --> proxy server (locked down w/IPS, AV, etc) --> router --> internet

Then you state:

Host --> Virtual (casual) --> gets firewalled here? --> back to host --> or gets firewalled here? --> router --> Internet

If V is not important, why bother wasting time and resources doing any filtering?

If you're that concerned about say banking, why not just use a bootable Linux cd whenever you're going to do something you perceive as mission critical. OR... Just throw up a proxy server running IDS, IPS, say Squid, and a firewall. I don't get your logic.

--- EDITED BASED ON OP's RESPONSE:

I think that you are going a bit overboard here. If you had a strong proxy, you wouldn't need to worry about a lot of attacks, since you would be able to strip data as it comes in, before it's even run in your network.

For example, with Squid used as a web proxy, you could do re-writes to remove java, javascripts, iframes, flash, etc., this greatly reduces the web attack vector. You can use YARA to further minimize as well. Which brings up another question / comment. If V is NOT that important, and used for casual things, why not just use a bootable version of Linux/BSD for THAT machine? That in itself removes a LARGE attack surface.