Virtualization. Block guest from accessing locahost - Page 1
Forum section: electronics / general

author: c64
author_rank: Frequent Contributor
timestamp: December 26, 2023, 12:28:09 am
content: I always use VM (Virtual Box) if I need to run dodgy/unknown software. Some of it may need access to the internet, so I give network access to guest VM. However, it also gives it access to the "localhost" on the host computer with the ability to attack it.Is it possible to give guest accessing to the network only but not the locahost?

author: c64
author_rank: Frequent Contributor
timestamp: December 26, 2023, 12:30:20 am
content: Host is Windows 7

author: 50ShadesOfDirt
author_rank: Regular Contributor
timestamp: December 26, 2023, 08:53:56 pm
content: Perhaps these two nifty forum articles, over at virtualbox.org, cover what you need:forums.virtualbox.org/viewtopic.php?t=107179forums.virtualbox.org/viewtopic.php?f=35&t=96608#p468780Hope this helps ...

author: Shonky
author_rank: Frequent Contributor
timestamp: December 27, 2023, 01:31:05 am
content: Set VM network device as bridged so it appears as its own network device and then VLAN to your router. It can live in its own subnet completely then.

author: garrettm
author_rank: Frequent Contributor
timestamp: January 07, 2024, 08:16:28 pm
content: If you have a USB NIC (wired or wireless), you could pass that over to the guest OS to bypass the host OS's NIC entirely. If you were on Linux and you have IOMMU capability with two onboard NICs, you can use KVM/QEMU to enable PCI pass-through of the second NIC. This is what I do for one of my Windows VMs under Linux. Generally, I disable networking for my Windows guest OS and instead use VirtioFS to pass files downloaded from the internet / my storage drive to the guest. If it isn't connected to the internet, you really don't need to update the OS, use Defender or the built-in firewall--which removes some of the fat-suit that MS requires to make their OS remotely safe to use. PCI pass-through can be used to move over an extra PCIe GPU, NVME drive or even whole USB or SATA controller for near native performance if you need Windows to play certain games or productivity software like CAD and the like.

author: dobsonr741
author_rank: Frequent Contributor
timestamp: January 07, 2024, 09:01:07 pm
content: Given that you mentioned “dodgy” downloads and your host is Windows 7, I would get an isolated sublet/DMZ off the router. Setting it up depends on your router and skills.And a windows update.Windows 7 is not getting security patches for 3 years now, so that presents a clear and present danger. More than 2000 vulnerabilities, if you patched up to the latest:https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-17153/Microsoft-Windows-7.html

author: c64
author_rank: Frequent Contributor
timestamp: January 11, 2024, 10:43:32 pm
content: I can not set up my cheap router to have a separate subnet. However, I managed to set up the host to be on a separate subnet (invalid one) using static IP and guest to use bridge network. Appears to be working fine. Host has no internet access which is fine. I have separate VM for web browsing and downloading stuff from the internet. Host is used for development and I prefer it to be offlinerouter subnet 192.168.0.xhost IP: 192.168.99.99, no gateway, no DNSguest: 192.168.0.100 (via DHCP)Thanks for hints regarding subnet

author: c64
author_rank: Frequent Contributor
timestamp: January 11, 2024, 10:45:28 pm
content: Quote from: garrettm on January 07, 2024, 08:16:28 pmGood option as well

author: madires
author_rank: Super Contributor
timestamp: January 12, 2024, 11:38:49 am
content: Quote from: c64 on January 11, 2024, 10:43:32 pmIs your router supported by OpenWRT?Quote from: c64 on January 11, 2024, 10:43:32 pmWith that setup make sure that IPv6 is disabled (SLAAC would make your host system reachable).

author: c64
author_rank: Frequent Contributor
timestamp: January 18, 2024, 02:55:14 am
content: No, it's not supported by OpenWRT. IP6 is disabled everywhere