Expose virtual machine to internet [pentest lab]

Question

I would like to create a virtual machine using virtual box for making a hacking lab and allow someone to try to hack it from internet. (So the virtual machine would be the victim). How can I do that? All the devices in my lan, virtual machines included share a unique ip i guess, so how can I expose my virtual machine? Is there a way? Should i setup port forwarding or use some other configuration? I apologize if this is a stupid question. Hope someone can help me if possible. Thanks in advance.

Answer 1

You should be very careful about what you plan on doing. If you want to expose the VM to the internet you should make absolutely sure that the VM is not able to communicate with the other devices in your network. Nevertheless, the attacker will be able to use your internet connection for illegal activites. It will be hard to prevent that and it requires a solid understanding of networking techniques. All in all, my advice is: don't do it, unless you absolutely know what you're doing.

Answer 2

What kind of device do you have for a router? Do you have shell access?

I had to help someone get full access to their box from the internet. I wasn't able to find an option in the web UI of the router (running Tomato), so I applied the changes directly, and then saved my changes in /etc/iptables. These changes would be wiped when the config was changed, though this might not be an issue depending on your choice of router.

The SNAT rule makes the packet appear to come from your local address (censored to 1.1.1.1 in this case) when the packet leaves your network for the internet. Many Linux router distributions like to implement their port forwarding with SNAT instead of the MASQUERADE rule that can be found by default.

iptables -t nat -I POSTROUTING -s 192.168.0.0/24 -o vlan1 -j SNAT --to-source 1.1.1.1

When someone from the outside attempts to connect to your public IP, the connection is sent to the local machine (192.168.0.123). Before it can reach the machine, it must first be accepted by the FORWARD chain.

iptables -t nat -A PREROUTING -d 1.1.1.1 -j DNAT --to-destination 192.168.0.123

If it makes it is accepted, forwarded to the local machine.

iptables -A FORWARD -d 192.168.0.123 -j ACCEPT

For your honeypot example, you might want a global accept like I posted above, though for my use case I wanted to restrict access to a known trusted IP, instead using this:

iptables -A FORWARD -d 192.168.0.123 -s 2.2.2.2 -j ACCEPT

If you're letting absolutely anybody connect to your location, I would place it on a completely separate subnet/collision domain to your normal computers, and make that your iptables setup bars all access to that domain.