Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I run a series of virtual machines on a server in which people connect to via Vnc. The computers are mostly used for penetration testing so the people involved are pretty techy.

My dilemma is that they can generally bypass the security of any on board software to restrict access to the internet. So I was looking at alternatives and I found a idea to run the internet through a proxy server. How would I best go about creating a proxy server? I have a spare box running linux if possible a way of doing this on a linux box would be greatly appreciated.

Just as a side question how dramatically will the internet slow down if I do decide to run it through a proxy the internet is currently running at 15mbps

Sorry if didnt go into enough detail i'll be happy to elaborate if necessary. Open source tools would be greatly appreciated.

share|improve this question
If you are doing penetration testing from those VMs, why do you need to restrict their internet access? Explain better where those VMs must connect (they do internal pen testing or external?). A proxy/firewall can greatly degrade the capacity of those VMs to use pen testing software. – coredump Mar 7 '11 at 4:41
I've not seen a properly configured proxy server slow down general Internet usage, so I wouldn't worry about that concern. coredump is correct in that Internet based pentesting would be very troublesome through a proxy. – Bret Fisher Mar 7 '11 at 4:50
It is all internal testing but some people are using the internet acsess to do external testing and I need a way from stopping this from happening the only reason the internet is there in the first place is to allow software updates . sorry for beiing vauge my arm is starting to twitch and is making it difficlt to type – lucas001 Mar 7 '11 at 5:16
up vote 1 down vote accepted

Assuming that the the users of the server will still be able to do their pen-testing work when there is a proxy in place, thhe best way to lock down network access would be with a (web) proxy server. Even with this in place there are still ways that this can be subverted, for example corkscrew - a tool for tunneling SSH through HTTP proxies.

One possible way around this would be to implement a white-list on your proxy, I.E. manually specifying the sites that the proxy allows access to. This unfortunately would be time consuming and difficult to maintain. It success would likely depend on the variety of websites that your users would need to access during their work.

With regards to what proxy software is good I would recommend squid. It is fast, open source and will run on linux. It some cases it will actually improve performance through caching of websites.

share|improve this answer

If you are looking for a way to control network access to and from all of the VMs, I would suggest creating a vitual instance of pfsense and moving all the VMs to an internal network. From there you could setup squid to filter web content, block ports, and log traffic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.