How to safely connect compromised machine to my network?

Question

Good day,

I often work on friends computers when they suspect a virus or some other malware and I'm wondering the best way to connect them to my network when I need to get out to the net. My home network is your simple cable modem into a Linksys router into a desktop. I want to connect this rogue machine to the router to get to the net, but I obviously don't want to risk infecting my own machine.

In the past, I've just simply powered off my own machine when it was time to connect the rogue machine, but this isn't always convenient.

My question is if I daisy chain two routers - in other words hang a separate router off my existing router and connect the rogue machine to that router - does that keep the two machines or maybe it would be appropriate to say two networks sufficiently sandboxed? Or is there even a better way?

Thanks!

Answer 1

You want to create a "DMZ", a demilitarized zone, to put the untrusted host on, and that's what you're suggesting, only you got the order wrong.

Cable modem <-- router <-- DMZ <-- router <-- trusted network.

Make sure you connect the visitor on the "outside" of the router you're own machine is on, that is, the WAN port on the router your home network uses should be connected to the "inside" switch port on the router that has its WAN port connected to the cable modem.

i.e. your inner router and the visitor both connect to the router connected to the cable, your desktop being the most "far away" from the internet.

Answer 2

The DMZ port/settings on most SOHO routers won't isolate the sick machine from the good ones. The DMZ host will get the same private network assignment, and thus, will be in the same layer-2 domain as the other hosts. Having a 2nd router, however, would keep the broadcast domains from overlapping. For extra protection, block all traffic from the infected router's WAN IP on the good router.

Answer 3

First off, your normal run-of-the-mill cable router speaks PPPoE on its WAN port, not IP, so it is doubtful you could chain two routers like this without buying a special router.

If you were to have a second router you'd want to place it in between your desktop and the Linksys to act as a firewall between the unsafe and safe portions of the network.

You would be best off using an old PC with a couple of network cards in it. Ideally 3:

1. connected to the internet router
2. connected to your desktop
3. connected to the rogue computer

You can then set up NAT and firewalling in the operating system of your choice to isolate the two networks. Or you could install a pre-built firewall product on the old PC, such as Smoothwall, IPCop or MonoWall etc.

                       +--------+
Desktop -----*s*------>|Nic 2   |
                       |        |
                       |   Nic 1|---------> Linksys
Rogue -------*s*------>|Nic 3   |
                       +--------+

In IPCop for example, the interfaces would be allocated as:

1. RED - the untrusted internet connection
2. GREEN - the trusted internal network
3. BLUE - an additional network that is unable to access the GREEN network but can access the RED network.

Depending on your network card's abilities you may well need to have either crossover cables or insert switches in your configuration at the * s * points in the diagram to link the computers to the firewall machine. If you use switches make sure you use 2 separate switches or one good switch that can isolate ports into separate VLANs to prevent any possibility of the GREEN and BLUE networks getting access to each other.