Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up a virtual machine on my network for uni project development. I have 6 team members and I don't want them to SSH in and start sniffing my network traffic. I already have set the firewall on my W7 pcs to ignore any connection attempts from the Virtual Machine, but would like to go a step further and not allow any network access from the VM to other machines on my network.

Team members will be access the VM by SSH. The only external port forwarded is to vm:22.

The VM is running in VirtualBox on a bridged network connection. Running latest Debian.

If someone could tell me how to do this I would be much obliged.

share|improve this question
If you don't want the virtual machine to sniff the local network traffic, why are you using a bridge instead of NAT? – Cristian Ciupitu Jun 13 '10 at 14:36
Non-superusers cannot put network devices in promiscuous mode. – amphetamachine Jun 13 '10 at 15:44
up vote 6 down vote accepted

Give your team members non-root access. This way they will not be able to sniff traffic.

If you do not want them to send traffic to your own network setup iptables to do:

  • Accept traffic for my_ip and my_router (your default gateway)
  • Drop traffic for my_network
  • Accept all other traffic

If your team members have root access you will need to put the VM behind a (virtual) router that does the filtering described above.

share|improve this answer
Thanks, this seems to have worked really well. Never looked at iptables - complex. Hope you get a chance to check this and let me know what you think. Only issue is I can't ping the VM from another machine on my network now - not quite sure why. iptables –A INPUT –p tcp –s 0/0 -–dport 22 –j ACCEPT iptables –A OUTPUT –p tcp –d 0/0 -–sport 22 –j ACCEPT iptables –A INPUT –s –j ACCEPT iptables –A OUTPUT –d –j DROP – Sam Jun 13 '10 at 16:57
Ping uses ICMP (i.e. neither TCP nor UDP), so you should also ACCEPT icmp. – Ole Tange Jun 22 '10 at 0:50

If you don't trust them in the local network, don't let them in there.

Maybe bridged networking is not the best solution.

You could use NAT and a secure router and forward only port 22 of the different machines (to different ports on the WAN port of the router)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.