Re: virtual honeynet with vmware

[Guillaume Rix <guillaume.rix () sun com>]

See my comments inline ...

> > Hi Patrick,
> >
> > Thanks for your answer.
> >
> > I amn't sure to understand very well.
> > Could you please to be more precise for explain this, what do you mean 
> > by "real" address ?
> >    
>
> What I mean by real, is an address which is routable on the internet as a whole. As discussed in RFC 1918 
> (http://www.faqs.org/rfcs/rfc1918.html).
>
> Briefly expressed, addresses in the 192.168.172.0 network, cannot route to the internet, and are only used internally.
OK, I understand.
However,  the 192.168.172.0 network should can communicate with the 
other internal network 129.157.178.0

> > In this case , it's a bridge mode of vmware, not a HostOnly Network, as 
> > preconise in the Know Your Ennemy : Learn with VMware.
> > I precise that I amn't the admin server for the 129.157.178.0 network.
> > And if I bridge the network 192.168.172.0 with the network 129.157.178.0,
> >    
>
> If you are using VMWare in Bridge mode, you should assign addresses to the guests in the same range as that of the 
> ethernet adapter you are bridging to.
>
> ie:
>
> 129.157.178.2 - VMware Host
> 129.157.178.11 - First VM
> 129.157.178.12 - Second VM
> 129.157.178.13 - Third VM
>  
I don't want use the VMWare's bridge mode, I talk about the bridge-util 
packdge here, not the VMWare's bridge mode.
The goal is to have all the GuestOS's route through the HostOS, my gateway.
In bridge mode, my GuestOS's will communicate directly with internet.

> > For resume my situation :
> >
> > I am on the network 129.157.178.0 with one fixed IP 129.157.178.165 on 
> > eth0 with RedHat9.
> > I can't change anything on the network 129.157.178.0.
> > I installed three GuestOS with VMWare in a Host-Only Networking 
> > 192.168.172.0 on vmnet1.
> > What are the routes that I must add ? and where ?
> > How use my fixed IP address 129.157.178.165 for continue to use my 
> > traffic of all the days ?
> >    
>
> If you only have one IP address, you can't really run multiple honeypots.
>
> What you can do, however, is run VMWare in host-only mode, and then forward only specific ports to guest OS'.
Yes, It's what I want, use the host-only mode.
How can I forward only specific ports to guest OS' ?

Guillaume

> Hope this helps =)
>
> - -- Patrick
>  
>
> > Cheers,
> > Guillaume
> >
> > Patrick McCarty wrote:
> >
> >    
> >
> > > -----BEGIN PGP SIGNED MESSAGE-----
> > > Hash: SHA1
> > >
> > >
> > > Hello,
> > >
> > > BRIDGE mode is not going to work properly when your guest OS' have RFC1918 
> > > addresses. If snort-inline bridges those from vmnet1 to eth0, they arn't 
> > > going to route anywhere. You'll have to assign them "real" addresses, in 
> > > your 129.157.178.x network, if in fact you wish to have them transparently 
> > > bridged.
> > >
> > > Additionally, currently your firewall script is blocking your 
> > > 129.157.178.x address on eth0, because it doesnt have knowledge of that. 
> > > (At least, thats how it appears from your excerpt below.)
> > >
> > > - -- Patrick
> > >
> > > On Wed, Oct 01, 2003 at 08:58:49AM +0200, Guillaume Rix wrote:
> > >
> > >
> > >      
> > >
> > > > Hi gang,
> > > >
> > > > I tried to implement a virtual honeynet GEN2 with Vmware.
> > > > Here is my limited architecture :
> > > >
> > > > HostOS ( access with internet):
> > > > ----------------------------------------
> > > >
> > > >     RedHat9
> > > >     One physical interface eth0
> > > >     eth0      Lien encap:Ethernet  HWaddr 00:x6:xB:6x:x6:Dx
> > > >     inet adr:129.157.178.xxx  Bcast:129.157.178.255  
> > > > Masque:255.255.255.0
> > > >     gateway : 129.157.178.1
> > > >
> > > >     One logical interface vmnet1 (Host-Only Networking with Vmware)
> > > >     vmnet1    Lien encap:Ethernet  HWaddr 00:5x:x6:Cx:0x:0x
> > > >     inet adr:192.168.172.1  Bcast:192.168.172.255  Masque:255.255.255.0
> > > >
> > > >
> > > > GuestOS :
> > > > -------------
> > > >
> > > >    OpenBSD3-3 ( ip=192.168.172.2 gateway=192.168.172.1)
> > > >    FreeBSD5-1r ( ip=192.168.172.3 gateway=192.168.172.1)
> > > >    Win2000Pro ( ip=192.168.172.4 gateway=192.168.172.1)
> > > >
> > > > Is this configuration correct (gateway, ip, etc ...) ?
> > > > Here, before to use rc.firewall for the bridge mode, my GuestOS can't 
> > > > contact the network 129.157.178.0 but
> > > > just the ip of the HostOS (129.157.178.xxx).
> > > >
> > > > Here is the principal configuration of my rc.firewall script :
> > > > ------------------------------------------------------------------------------
> > > >
> > > > PUBLIC_IP="192.168.172.2 192.168.172.3 192.168.172.4"
> > > > INET_IFACE="eth0"
> > > > LAN_IFACE="vmnet1"
> > > > LAN_BCAST_ADDRESS="192.168.172.255"
> > > >
> > > > After I execute this script, I can't communicate with the external 
> > > > address from my HostOS with eth0.
> > > > Am I impose to have two physical interfaces ?
> > > > One eth0 for enter to the network 129.157.178.0,
> > > > and another one eth1 for use with the bridge ?
> > > > In fact, I am completly confuse here and here is what I want :
> > > >
> > > > Continue to use my HostOS for access to intranet (with my static IP 
> > > > 129.157.178.xxx) and internet.
> > > > Build a virtual honeynet with vmware on a Host-Only Networking 
> > > > 192.168.172.0
> > > > For genII, I need to use the firewall in bridge mode.
> > > > Allow to my GuestOS to acceed to the intranet 129.157.178.0 and more.
> > > > Can I use a virtual IP for my bridge for keep my eth1 with the IP 
> > > > address 129.157.178.xxx ?
> > > >
> > > > I hope that my requests are not bad.
> > > > Please help me to find a solution for this situation.
> > > > Thanks in advance for your comments on this.
> > > >
> > > > GR
> > > >
> > > >  
> > > >
> > > >        
> > > -----BEGIN PGP SIGNATURE-----
> > > Version: GnuPG v1.2.2 (GNU/Linux)
> > >
> > > iD8DBQE/exafpPYocrgNjZgRAuJ4AJsG0wA3nrja0ZUgw8Fn1yZem44CvgCfWW2Y
> > > t3ula2I7L+diBWdUktMjjfQ=
> > > =POBc
> > > -----END PGP SIGNATURE-----
> > >
> > >
> > >
> > >      
> >    
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (GNU/Linux)
>
> iD8DBQE/e1pJpPYocrgNjZgRAqn6AKDOMr3BIDsCD5OdoiGgJm4QZRoxGQCfU2zr
> pIOdcpyUAJqPpx8Zrgg82nE=
> =RHly
> -----END PGP SIGNATURE-----
>
>