0

I have set up a virtual machine on my network for uni project development. I have 6 team members and I don't want them to SSH in and start sniffing my network traffic. I already have set the firewall on my W7 pcs to ignore any connection attempts from the Virtual Machine, but would like to go a step further and not allow any network access from the VM to other machines on my network.

Team members will be access the VM by SSH. The only external port forwarded is to vm:22.

The VM is running in VirtualBox on a bridged network connection. Running latest Debian.

If someone could tell me how to do this I would be much obliged.

2
  • 3
    If you don't want the virtual machine to sniff the local network traffic, why are you using a bridge instead of NAT? Jun 13, 2010 at 14:36
  • 1
    Non-superusers cannot put network devices in promiscuous mode. Jun 13, 2010 at 15:44

2 Answers 2

6

Give your team members non-root access. This way they will not be able to sniff traffic.

If you do not want them to send traffic to your own network setup iptables to do:

  • Accept traffic for my_ip and my_router (your default gateway)
  • Drop traffic for my_network
  • Accept all other traffic

If your team members have root access you will need to put the VM behind a (virtual) router that does the filtering described above.

2
  • Thanks, this seems to have worked really well. Never looked at iptables - complex. Hope you get a chance to check this and let me know what you think. Only issue is I can't ping the VM from another machine on my network now - not quite sure why. iptables –A INPUT –p tcp –s 0/0 -–dport 22 –j ACCEPT iptables –A OUTPUT –p tcp –d 0/0 -–sport 22 –j ACCEPT iptables –A INPUT –s 10.0.1.0/24 –j ACCEPT iptables –A OUTPUT –d 10.0.1.0/24 –j DROP
    – Sam
    Jun 13, 2010 at 16:57
  • Ping uses ICMP (i.e. neither TCP nor UDP), so you should also ACCEPT icmp.
    – Ole Tange
    Jun 22, 2010 at 0:50
3

If you don't trust them in the local network, don't let them in there.

Maybe bridged networking is not the best solution.

You could use NAT and a secure router and forward only port 22 of the different machines (to different ports on the WAN port of the router)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .