Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are discussing the potential of issuing standardized VM images to our staff to use when connecting to our corporate network from their personal computers.

Ideally they could run this VM on any hardware they have available. Since we wouldn't control the hardware or host OS, there would be the fairly high potential of malware infestations, restricted software, bad software interactions, etc. on the host.

What would be the best/simplest way to allow the VM to connect to our corporate network, while at the same time prevent the host computer from connecting?

The solution should:

  • allow the user to connect via wireless or ethernet in our office, or over VPN from outside the office
  • prevent the host computer from connecting altogether, although our office provides guest wireless access, which would be acceptable for the host computer.
  • not disrupt functionality of corporate computers (not personal computers, not VMs) which are under our control
  • not be administratively intensive, such as maintaining whitelists of MAC addresses, etc.


  • The VMs will likely either be VMWare or VirtualBox based
  • The VMs will run Windows XP or Windows 7
  • The hosts could be mac/linux/windows
share|improve this question
why not windows 2008 r2 in rdp with directaccess and published applications – tony roth Oct 27 '10 at 20:25
up vote 2 down vote accepted

To prevent the hosts from accessing resources I think you may have to look at using IPSec for Domain or Server Isolation. The hosts won't be in the domain, so IPSec will prevent them from communicating with the other Domain machines, but the VMs will be in the domain so they can communicate with each other.

This looks like a really good starting point.

share|improve this answer
Thanks, this looks like it has alot of potential. – Brent Oct 27 '10 at 18:36

There are two approaches I'd consider;

  1. Use VMWare ThinApp - take a VM and mini-hypervisor and makes a single .exe from them, there's literally nothing that they can do to change the way the VM works. You'd just have a VM with a VPN client inside that gave them what they wanted and nothing more. This only works on Windows though, so alternatively you could just run the same VM in VMWare Workstation for Windows & Linux and Fusion for Mac.
  2. Use something like Citrix or VMWare View to run these machines within your network but the users can only use them from a web-browser, seriously limits their options to mess you about.
share|improve this answer

If these VMs will be joined to a domain, perhaps you can utilize client certificates on your VPN such that only computers which have a client certificate can connect to the VPN. That will prevent unauthorized computers from connecting (hosts) while allowing authorized ones to do so (VM's). While the VM is on the VPN, you can enforce it to only allow traffic to the destination network to prevent split horizon traffic. If you have a user who is tech savvy enough, they'll be able to get around it, but the same goes for most solutions.

share|improve this answer
If I'm understanding you, you're suggesting that we require VPN to access our network at all, even from inside. That's fine for the VMs, but would be too much of a change for the corporate computer users (who are many) – Brent Oct 27 '10 at 18:35
Oops, I misunderstood your request. I thought you meant from a remote location - not from the actual corporate location. – Dan Oct 27 '10 at 18:48
This will affect both people who work within our office, using their personal laptops, as well as those who remain outside. – Brent Oct 28 '10 at 14:53

you could deploy machine certificates as the second factor for VPN authentication.

for preventing ethernet and wireless access from rogue devices, you can either make everyone VPN into the secured zone, or deploy 802.1x.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.