How to prevent virtual host from connecting to network?

Question

We are discussing the potential of issuing standardized VM images to our staff to use when connecting to our corporate network from their personal computers.

Ideally they could run this VM on any hardware they have available. Since we wouldn't control the hardware or host OS, there would be the fairly high potential of malware infestations, restricted software, bad software interactions, etc. on the host.

What would be the best/simplest way to allow the VM to connect to our corporate network, while at the same time prevent the host computer from connecting?

The solution should:

• allow the user to connect via wireless or ethernet in our office, or over VPN from outside the office
• prevent the host computer from connecting altogether, although our office provides guest wireless access, which would be acceptable for the host computer.
• not disrupt functionality of corporate computers (not personal computers, not VMs) which are under our control
• not be administratively intensive, such as maintaining whitelists of MAC addresses, etc.

Details:

• The VMs will likely either be VMWare or VirtualBox based
• The VMs will run Windows XP or Windows 7
• The hosts could be mac/linux/windows

Answer 1

To prevent the hosts from accessing resources I think you may have to look at using IPSec for Domain or Server Isolation. The hosts won't be in the domain, so IPSec will prevent them from communicating with the other Domain machines, but the VMs will be in the domain so they can communicate with each other.

This looks like a really good starting point. http://blogs.msdn.com/b/james_morey/archive/2005/04/21/410590.aspx

Answer 2

There are two approaches I'd consider;

1. Use VMWare ThinApp - take a VM and mini-hypervisor and makes a single .exe from them, there's literally nothing that they can do to change the way the VM works. You'd just have a VM with a VPN client inside that gave them what they wanted and nothing more. This only works on Windows though, so alternatively you could just run the same VM in VMWare Workstation for Windows & Linux and Fusion for Mac.
2. Use something like Citrix or VMWare View to run these machines within your network but the users can only use them from a web-browser, seriously limits their options to mess you about.

Answer 3

If these VMs will be joined to a domain, perhaps you can utilize client certificates on your VPN such that only computers which have a client certificate can connect to the VPN. That will prevent unauthorized computers from connecting (hosts) while allowing authorized ones to do so (VM's). While the VM is on the VPN, you can enforce it to only allow traffic to the destination network to prevent split horizon traffic. If you have a user who is tech savvy enough, they'll be able to get around it, but the same goes for most solutions.

Answer 4

you could deploy machine certificates as the second factor for VPN authentication.

for preventing ethernet and wireless access from rogue devices, you can either make everyone VPN into the secured zone, or deploy 802.1x.