LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 08-12-2020, 09:01 AM   #16
michaelk
Moderator
 
Registered: Aug 2002
Posts: 20,550

Rep: Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595Reputation: 3595

Yes, I picked pfsense since that is what I run but others or just a min install distro should work too.

<LAN> <-> <bridged adapter as WAN > <-> firewall/gateway VM <-> <host-only adapter as LAN > <-> VM

The devil is in the details and it all depends on creating the right rule to only allow gateway traffic.

With the DMZ I think you would need a separate wire which also requires a USB to Ethernet adapter in this case. Regardless pan64 indicated a second wire was not possible.

Last edited by michaelk; 08-12-2020 at 09:04 AM.
 
Old 08-12-2020, 09:22 AM   #17
pan64
LQ Guru
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 15,422

Original Poster
Rep: Reputation: 5062Reputation: 5062Reputation: 5062Reputation: 5062Reputation: 5062Reputation: 5062Reputation: 5062Reputation: 5062Reputation: 5062Reputation: 5062Reputation: 5062
Quote:
Originally Posted by michaelk View Post
Yes, I picked pfsense since that is what I run but others or just a min install distro should work too.

<LAN> <-> <bridged adapter as WAN > <-> firewall/gateway VM <-> <host-only adapter as LAN > <-> VM

The devil is in the details and it all depends on creating the right rule to only allow gateway traffic.

With the DMZ I think you would need a separate wire which also requires a USB to Ethernet adapter in this case. Regardless pan64 indicated a second wire was not possible.
Yes, you are right, second wire is not a [good] choice. I would probably try this firewall/gateway setup in docker (or in VM?).
For me it looks relatively simple, allow anything to/from router/gateway and deny anything else on the subnet of home network. But correct me if I was wrong.
If nothing works I will also try DMZ, but only as a last chance.
 
Old 08-12-2020, 05:15 PM   #18
wpeckham
Senior Member
 
Registered: Apr 2010
Location: Continental USA
Distribution: Debian, Ubuntu, Fedora, RedHat, DSL, Puppy, CentOS, Knoppix, Mint-DE, Sparky, Vsido, tinycore, Q4OS
Posts: 3,468

Rep: Reputation: 1510Reputation: 1510Reputation: 1510Reputation: 1510Reputation: 1510Reputation: 1510Reputation: 1510Reputation: 1510Reputation: 1510Reputation: 1510Reputation: 1510
Quote:
Originally Posted by pan64 View Post
This is exactly the opposite. I want to hide everything but the router and the outer net/space from the VM.
Imagine, I want to do (examine?) strange things inside this VM, but I want to protect all my home network.
Wait, do you mean that you want the virtual machine exposed to the internet, but with no access to the local network?

Tricky!
Still using manual configuration of a bridged interface: Define a new subnet JUST for the VM. Give it a default route to the gateway, but route the internal subnet it is NOT on the the LO (local) interface at 127.0.0.1. There are other ways, but if you know how to get this working it should suffice.

Actually the subnet of the VM can be a smaller subset (two nodes) of the full internal network. As long as it can ONLY reach itself and the router using that subnet you are golden.

I must say, this is backwards to everything I have seen, and not what I understood you wanted to accomplish. Good luck with it.

This may take a little work on the router to get right, but even without that the routing of the rest of the subnet to an interface nothing exterior can reach should isolate that node from the rest of your internal.

Last edited by wpeckham; 08-12-2020 at 05:18 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
isolate libvirt / kvm guests in virtual network tux111 Linux - Virtualization and Cloud 3 12-22-2019 07:31 AM
how to isolate redundent libraries? dejavu_01 Slackware 3 08-24-2005 01:28 AM
How do I isolate a piece of string? vous Programming 4 03-16-2005 01:43 PM
911 Dispatch PC Security :: Isolate Internet Viruses danfig General 2 01-05-2005 08:30 PM
Elderly PC may have a HW fault - how to isolate/fix? CestusGW Linux - Hardware 3 03-24-2004 04:11 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 07:13 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration