Gfrktyl

My home desktop computer has two NICs. I use one for my personal internet needs, and plan to use the other one somewhat unconventionally. I'm going to create a SOCKS/VPN server on a virtual machine, use it exclusively with the spare network NIC, and give it its own public static IP address. I currently have one gateway "router" and one modem as discrete components.

There are two areas of this plan that are still a mystery to me.

1. I can isolate the VM traffic to one of the NICs, but how do I isolate the host machine's traffic to the other one?




2. What's the safest and cheapest way to set this up?

As I understand it, I could get a router that is flashable with dd-wrt or OpenWrt, which would allow me to use 1:1 NAT and expose both IPs publicly. I could then put my existing gateway between the host machine's NIC and the router for an additional layer of security. As the VM is used more seriously it will likely require a hardware security layer inside the router as well.

Alternately, I could get a switch and another gateway. I haven't bought a switch before and I'm not sure what to look for in this context.

Am I missing other possibilities?

You could isolate roothost simply by not enabling/configuring L3 on the roothost interface for that NIC (assuming the hypervisor provides network to VM via bridged L2 interface). This will provide traffic separation and basic security (ie. not exposing roothost to VM).

As for tougher security, what are your real requirements/worries here?

From roothost to VM, this will always be sketchy thing.

Between VM and network, you don't really need more hardware. You could deploy another VM with OpenWrt or, well, any other security-enabled router and then pass traffic through it. Then connect the external, bridged L2 to router VM and connect target VM to router VM via separate virtual switch.

But why even to consider external firewall, when you may use internal one, at the OS in target VM?

Security-wise, I wouldn't really use a 1:1 NAT, but only expose/forward the required ports. Gives you more control and provides an additional layer of security/complication against attacker.

If the ISP configures the 2nd address to be 'routed' to your main IP address (or if your Internet uplink from the router is some point-to-point technology like PPPoE):

• You can assign the IP address to the router, and perform DNAT to the server's internal address.




• If the router supports custom static routes, 1:1 NAT is useless – you can add a static route for the 2nd IP address either to the server's LAN address or to the LAN interface itself, then assign that address (as a /32) to the server directly.

If your Internet uplink from the router is standard Ethernet (and not PPPoE) and if the ISP configures the 2nd address as 'on-link':

• You can place a generic switch in front of the router's WAN port and connect the server to it. An unmanaged switch will do. In this case you would need to use the server's own firewall, being very careful about not accidentally exposing e.g. iLO/iDRAC to the Internet.




• You can assign the IP address to the router, and perform DNAT to the server's internal address, same as above.




• You can assign the IP address directly to the server, then enable proxy-ARP and add a static route for that address on the router (same as above except for the proxy-ARP thing).

In any case, port whitelisting can be done through the firewall either on the router or on the server, independent of NAT or routing modes.