1

Scenario: 1 VirtualBox host with many vms. Different host-only networks are configured for different vm categories: Some vms are "private", others are "standard" vms. Most of these vms, including some of the private vms, also have a nat interface because they need to be connected to the Internet.

What's the recommended way to prevent private vms from accessing standard vms (and vice versa) through their nat interface?

Example:

  • 2 host-only networks:
    • vboxnet0 (192.168.56.0/24) = "private"
    • vboxnet1 (192.168.57.0/24) = "standard"
  • VM #1 (private vm with Internet access) has 2 virtual interfaces:
    • NAT (10.0.2.0/24) for Internet access
    • Host-only network vboxnet0
  • VM #2 (private vm) is configured like vm #1.
  • VM #3 (private vm without Internet access) has 1 virtual interface:
    • Host-only network vboxnet0
  • VM #4 (standard vm) has 2 virtual interfaces:
    • NAT (10.0.2.0/24) for Internet access
    • Host-only network vboxnet1
  • VM #5 (standard vm) is configured like vm #4.
  • Internet access is provided by the vm host's default gateway.
    • VM host: 192.168.0.100
    • Gateway: 192.168.0.1
  • Some vms have no firewall enabled and some vms are not trusted, so nothing should be changed in the guest systems.
  • Host system runs on Linux and uses iptables.

VM #3 is isolated, it does not have access to anything except 192.168.56.0/24. Also, vms #1 and #2 can talk to each other (like #4 and #5), which is good.

However, private vm #1 can reach standard vm #4. It can also talk to the host's standard ip 192.168.57.1 and its physical ip 192.168.0.100, bypassing firewall rules that are meant to prevent private vms from accessing services on the host. In this scenario, private vms with Internet access are not supposed to be able to have access to the standard subnet (vboxnet1) or other vm subnets. In other words, their NAT interface should only allow them to reach 192.168.0.1 in order to have Internet access, but not any other (local) network.

Is it possible to restrict the virtual NAT interface like this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.