3

I have a quick question. This is more of a concept question than an actual problem, but basically what I'm trying to do is set up a malware analysis lab on one of my company's computers. I already have a Base Windows machine with a bunch of VMs for analyzing the malware. Where my problem comes in is that I want the malware I'm analyzing to be able to go out to the internet so it can function properly, but have no chance of reaching the internal network. I am using the Watchguard XTM 2 Series firewall, and would like some input on how I can achieve this. What is the best way to go about doing this? Something like a DMZ so malware traffic can go in and out on the internet, but not come into our main network? I couldnt find any tutorials on how to configure it correctly, but I can do some more searching once I know what I want to do is right. Thank you!

  • You might want to move this to security??? (the subject does straddle the fence) – Ricky Beam Jun 16 '15 at 20:52
2

have no chance of reaching the internal network

To the letter, that means a 100%, completely separate network. Cables, switches, router, everything. Short of a physical cabling mistake, there's no chance of the test environment touching the internal network.

However, I understand how that can be unattainable. So, you'd then fall back to using VLANs to create "virtual" isolation, and either a DMZ VLAN subinterface, or secondary real interface, at the firewall/router -- or a second firewall. The firewall/router would then require ACLs and/or other security rules to prevent the internal and DMZ networks from interacting -- beyond what very limited access you may want for management access.

I cannot overstate the need for as much physical isolation as possible. Even your VM host is a possible vector into your internal network -- don't count on the "VM" staying inside it's container.

(I've not touched a Watchguard in eons, so I cannot give you any details on how to configure yours.)

| improve this answer | |
  • Thanks for the info, I looked into that a little bit, and I think I know what I have to do now. I had to use the Optional interfaces to provide some more physical isolation. – ToxicProxy Jun 16 '15 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.