9

I want to setup a lab to try Suricate, an IPS system. The thing is that I need to set it up like this:

Atacker VM ----- Inline IPS VM ----- Victim VM How can I accomplish this? I don't see a way to setup a virtual host with 2 NIC, putting it in the middle of the connection. Can it be done somehow?

  • BTW, I used Security Onion: sourceforge.net/projects/security-onion It's a Xubuntu ISO that configures in a pretty simple manner Snort or other sensors and the log parsing tools to make it GUI fun. So, it' amazingly simple, check it out! – user2723297 Nov 8 '13 at 12:58
9

In your schema we can see that you need two separate LANs. Let's call them LAN-Attacker and LAN-Victim. On the Attacker VM and Victim VM you will need a single virtual network adapter for each VM. On the IPS VM you will need two virtual network adapters. You can add and configure the adapters in the Virtual Machine Settings Window on the Hardware tab.

Do not be confused by the fact that there are two separate LANs. They can be in the same IP subnet if your IPS is going to perform as a bridge (layer 2 device). They can also be in two different IP subnets if the IPS is going to act as a router (layer 3). This depends just on your networking configuration inside the virtual machines.

Now there are two options how to configure and connect the two LANs.

LAN Segments

In VMware Workstation 8.0 and newer you can use LAN Segments for local virtual networks which need to communicate only with virtual machines. This configuration is considerably easier. enter image description here In the Virtual Machine Settings Window on the Hardware tab select a Network Adapter and click on the LAN Segments buttons. Create the two LAN Segments LAN-Attacker and LAN-Victim. On each virtual network adapter select the corresponding LAN Segment.

Be aware of the fact that the machines which are connected only to LAN Segments will be able to communicate (over network) neither with the physical host nor with the external physical networks.

Virtual Networks vmnetx

In all versions of VMware Workstation you can use virtual networks. You can configure them using the Virtual Network Editor (in the Edit menu). The virtual networks are called vmnetx where x is the number of the virtual network. Either configure unused ones or create new ones. enter image description here There are three types of virtual networks:

  • Bridged - They are connected to a physical network your physical host has access to on the layer 2. The virtual machines connected to this vmnet then look like they are directly connected into the physical network.
  • NAT - There is a virtual network but the physical host performs dynamic NAT so the machines connected to this vmnet can communicate with physical networks. (and each to other - see below)
  • Host-only - This vmnet is like NAT but without the NAT and access to the outside physical networks. So the machines connected to this vmnet can communicate only each to others including the physical host if you select the option "Connect a host virtual adapter".

In your case you will use either Host-only or NAT (if the machines need to communicate with the outside world). In fresh VMware Workstation installation vmnet0 - vmnet2 are pre-defined so you can probably use vmnet3 as LAN-Attacker and vmnet4 as LAN-Victim.

In the virtual machines you then assign the corresponding vmnets to the virtual network adapters a similar way like LAN Segments above just select the option "Custom: Specific virtual network" instead of "LAN Segment".

  • Hey man, thanks for the thorough answer. I'll test it and let you guys know. So it's basically: ATACKER'S PC (10.0.0.1/8, for example) ---- LAN segment 1 ---- IPS ---- LAN segment 2 ---- VICTIM'S PC (10.0.0.2/8, in the same range, to force the IPS to be in the middle). So if I do this, the IPS will be automatically put inline? I don't get why. Why does VMware interpret that this means the host with the 2 LAN segments should be in the middle? – user2723297 Nov 8 '13 at 2:14
  • You are welcome! Attacker PC and interface 1 of IPS are both connected to LAN1. Victim PC and interface 2 of IPS are both connected to LAN2. So Attacker and Victim are in two separate LANs. They cannot communicate directly. The only way is to go through the IPS which is connected both to LAN1 and LAN2. ------ Of course for this to work IPS must play a special role. It must be configured as a bridge (in the case LAN1 and LAN2 are in the same subnet - here 10.0.0.0/8). How bridges work? See for example: Ethernet Bridges & Switches. – pabouk Nov 8 '13 at 8:22
  • Oh yeah, gotcha. Without configuring the Linux IPS box as a bridge, it surely would drop the broadcast packets that would give Attacker the MAC address for victim. And obviously if I were to hard code the MAC address in the ARP table of attacker, IPS would still drop them. Found the way here: linuxfoundation.org/collaborate/workgroups/networking/bridge It's pretty simple! Thanks a lot. – user2723297 Nov 8 '13 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.