0

I have been asked if there is a solution to expose a single machine (Linux Server with honeypot installed) to multiple VLANs, I mean, a single machine will have many IP addresses belonging to each VLAN. The goal is to host a honeypot to every VLAN which exists in the network.

I have a Linux box with a gigabit Ethernet card (let's say eth0), and I thought maybe using virtual interfaces configured like this:

eth0:1 -> IP 10.10.0.15 / GW 10.10.0.1

eth0:2 -> IP 10.10.1.15 / GW 10.10.1.1

eth0:2 -> IP 10.10.5.15 / GW 10.10.5.1

and so on. So each VLAN might be accessible within each one of the virtual interfaces.

Is this even possible to achieve with the default Debian 9?

|improve this question
3

First, it is important to remember that without a bunch of weird(complex) routing, you can only have a single default gateway.

Ignoring the routing/gateway issue a /etc/network/interfaces file on a Debian might look like this assigning IPs from multiple VLANs.

# native vlan
iface eth0 inet static
        address 10.10.0.15
        netmask 255.255.255.0
        gateway 10.10.0.1

# tagged vlans

# iface eth0.VLAID inet static
#        address 10.10.VLAID.15
#        netmask 255.255.255.0

iface eth0.10 inet static
        address 10.10.10.15
        netmask 255.255.255.0

iface eth0.20 inet static
        address 10.10.20.15
        netmask 255.255.255.0
|improve this answer
  • Great answer by Zoredache as ever but be aware that it you're using a very recent RHEL-variant that a lot of the network setup has changed, if you are then just use the online documentation or come back to us ok. – Chopper3 Jan 4 at 22:13
  • @Chopper3 they did mention using Debian 9 in their question. Which will support the older both the older style of config ifupdown which my example is for. Debian 9 also supports the systemd method of network configuration out of the box, but I didn't have tested VLAN example handy for that. – Zoredache Jan 4 at 22:16
  • 1
    Zoredache is correct... I would only add (if it's not clear enough) that there is no need to configure virtual network interfaces like eth0:1, eth0:2, etc., you can use directly tagged VLANs instead (eth0.10, eth0.200, etc.); manually you can create VLAN by ie. ip link add link eth0 name eth0.10 type vlan id 10 and add IP address with ip addr add 192.168.1.200/24 brd 192.168.1.255 dev eth0.10 and after bring it up with ip link set dev eth0.10 up (this is iproute2 method) – patok Jan 4 at 22:20
  • Sorry yes, completely missed that! – Chopper3 Jan 5 at 12:38

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.