I recently started taking a course at Offensive Security. On their connectivity guide page, they warn about the hazards of connecting to their labs:

you will be exposing your computers' VPN IP to other students taking the course with you. Due to the nature of the course (and its participants!), your computer may be subjected to attacks originating from the VPN network. This is true even if you are located behind a NAT device.

I have contacted their support, to learn more about those hazards, and how to protect my PC. They suggested that I could "separate the IP segment of the VM with the host machine".

The VM is a VMWare virtual machine with Kali Linux. The host is a Windows 10 PC.

How can I achieve what they suggested, and "separate the IP segment of the VM with the host machine"?

1 Answer 1


I initially wrote this with a separate VMware/ESXi host in mind. If you must use your working Windows 10 machine (with VMware Workstation), you need to create/use an isolated virtual network that is not bridged to the hosts outgoing interface. VMware Workstation should have created one for you initially. Your host is however still exposed to this network, which places your working computer at risk.

I recommend a separate ESXi host with a separate virtual switch with no physical adapter attached. Create a port group on this (isolated) virtual switch. The Kali Linux VM should have only this port group attached. You can view the VM remotely through ESXi management, which should be on its own network segment or on a separate VLAN from your internal network. You will not have ssh access to the Kali VM then. The VM will only have access to a network internal to ESXi.

This VM will not have Internet access. To provide Internet access, which may not be desirable, you could install a firewall VM (e.g., OPNsense or pfSense). To use this firewall for your own internal network and for the Kali VM, put your ISP router into bridge mode which places its internal network ports on the live Internet and not on NAT (to avoid confusing double NAT). Use a dedicated physical ethernet adapter for WAN (in addition to adapters for LAN and management, which can be just VLANs on one separate adapter in a pinch). It is imperative this host machine's WAN interface is not exposed to your internal network-- or if it must, very careful rules must be constructed to force all the Kali VM traffic out to the Internet. The firewall VM will need an interface to the Kali Linux port group. Be sure to create rules on all firewall interfaces to restrict access to the Kali network.

  • The Offensive Security labs require an OpenVPN connection. To use your working PC, a network segment not bridged to an outgoing network is not viable. The Kali Linux VM should be on an isolated network segment on a dedicated host with Internet access with a dedicated WAN interface using a firewall VM with rules to prevent access to your internal network. This forces all Kali Linux traffic away from your internal hosts. You could put a dedicated (VM) machine in a DMZ network with your existing firewall/router, but there might be double NAT and likely a loss of security. Jul 26, 2020 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.