1

Virtualised environments are focused on isolating the guest OS. Using the VirtualBox model, the guest might be behind a virtual NAT and/or talk only with other VMs via internal networks, and only with the host via host-only networks.
All these methods are meant to make the host invisible and unreachable from the outside internet, while allowing inbound connections from other VMs and host.

What if one runs server services on the host for the guests?
Is it possible to shield the host from the outside world, while allowing inbound traffic from the guest machines?

A simple method would be restricting the listening ports on the host to the virtual machine/network IPs. But another box sitting in the same network of the host might spoof the IP and pretend to be a VM. Outside the host the gateway device might check for the actual IP of the spoofer matches its packet sources But we don't know who is and how wary is the admin. So how can we manage security inside the host? For example have the host listening only to inbound traffic from VMs.

3

That is what VirtualBox's host-only networking mode is for. It creates a virtual network adaptor on the host and connects it to a virtual network adaptor in the guest.

Then you just tell the services running on the host to only listen on the virtual adaptor.

See section 6.7 of the VirtualBox manual for more details.

  • As I wrote I can easily "tell the services running on the host to only listen on the virtual adaptor", but how can I be sure that this works when someone outside the host, spoof his/her IP, pretending to be (in) the virtual adaptor (subnet)? – antonio Sep 24 '14 at 11:20
  • 3
    Those packets are not coming in on the Virtual network adaptor, but on the physical network adaptor, so if the service is only listening on the virtual it will not get the packets that come in from the physical. – Graham Hill Sep 24 '14 at 11:26
  • Better if I try with some example. Say the host server service is NFS; say the host-only network subnet is 192.168.0.0/255.255.255.0; say NFS is restricted, via /etc/hosts.allow, to portmap: 192.168.0.0/255.255.255.0. Now a box external to the host spoofs packet sources as 192.168.1.1: will NFS daemon discard them? Can I restrict NFS to the interface vboxnet0, instead of the IPs? – antonio Sep 24 '14 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.