1

I have the following setup:

  • a few client computers
  • 1 Hyper-V Server Core 2012 R2
    • 1 Windows Server 2012 R2 (Domain Controller)
    • 1 Windows 7 computer.

Now the Hyper-V server has 2 virtual switches 1 internal between the 2 virtual pc's and one that connects them to the router.

Now my question is there some way to isolate the Virtual Windows 7 computer from the rest of the network and only allow it PPTP, DNS and GRE access to specified servers? (excluding the communication with the domain controller via the internal network switch?)

How i accomplish this doesn't really matter, tried to configure the router but that didn't work..

Network setup

Any suggestions?

3
  • Not possible. To isolate a computer entirely you cannot grant it internet access.
    – AStopher
    Dec 1, 2014 at 11:59
  • I would say that in theory it might be possible to configure your network in such a way that you HAVE to be connected to a VPN in order to access the network but that would disconnect you from the internal network also if you were disconnected. Doing so would not isolate you from anything while connected to the client, and usage case for a computer not connected to anything, is sort of non-existent since you also wouldn't be connected to a domain either.
    – Ramhound
    Dec 1, 2014 at 12:11
  • @cybermonkey could you elaborate on your statement?
    – Peter
    Dec 1, 2014 at 13:57

1 Answer 1

1

You can get quite a reasonable attraction by configuring your physical machines as 10.0.0.0/8 and putting the virtual machines as 192.168.0.0/16. Only the gateway would know about the two networks, and it would be configured not to route traffic between the two networks.

You'd put the virtual network card in bridged mode, to make it virtually appear on the Ethernet without going through the host OS.

7
  • I don't want to restrict the Domain Controller only the Window 7 virtual machine but i guess i would only put that machine on the 192.168.0.0/16 network, but this would not restrict it from only using the specified protocols..
    – Peter
    Dec 1, 2014 at 12:20
  • @Peter - If its connected to the domain controller then it has to be connected to the rest of the network.
    – Ramhound
    Dec 1, 2014 at 12:22
  • Well, DNS is a federated system anyway. Put a DNS proxy on the Windows Server, and point the Windows 7 DNS client to your own server. And for the other protocols, the 192.168.0.0 network only connects to your router which presumably can do port filtering.
    – MSalters
    Dec 1, 2014 at 12:25
  • @Ramhound why would i have to be that? (the internal Hyper v Switch would only connect those 2 machines?)
    – Peter
    Dec 1, 2014 at 12:26
  • @MSSalters, if i enable port filtering on my router it disables GRE and i have no way to activate it essentially killing PPTP
    – Peter
    Dec 1, 2014 at 12:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .