Let the diagram below be a representation of a LAN.
- let R be the interface between the LAN and the internet.
- H be host connected to the LAN.
- F be a firewall implemented using a virtual machine controlled by H.
- V be a virtual machine controlled by H.
- F is also the interface between the LAN and V.
- F also blocks all traffic from V destined for H.
R
|
+--+--+
| |
F H
|
V
Consider:
- H uses V for all insecure/casual internet activity
- H does all secure/private activity by itself (ie. banking)
How secure is this?
I know the user will be largely responsible for most breaches, like reusing passwords, or pulling files out of V, or using a VM that V can escape; but, aside from user error, is H safer?
Since V will be doing most of the insecure stuff, I can only see attackers targetting V because V is the only one that's out there that they can identify. Any viruses/attacks from V would be blocked completely by F if F is set to block all traffic on the LAN between them too. So, yeah, come break this setup.
I want to know if separating insecure activity with secure ones can make a host safer.
--- edit
So, probing the network will unveil H. In terms of V getting infected, though, can any of its infections reach H?
And yeah, H should be behind a firewall of its own.