Malware lab with watchguard firewall

Question

I have a quick question. This is more of a concept question than an actual problem, but basically what I'm trying to do is set up a malware analysis lab on one of my company's computers. I already have a Base Windows machine with a bunch of VMs for analyzing the malware. Where my problem comes in is that I want the malware I'm analyzing to be able to go out to the internet so it can function properly, but have no chance of reaching the internal network. I am using the Watchguard XTM 2 Series firewall, and would like some input on how I can achieve this. What is the best way to go about doing this? Something like a DMZ so malware traffic can go in and out on the internet, but not come into our main network? I couldnt find any tutorials on how to configure it correctly, but I can do some more searching once I know what I want to do is right. Thank you!

Answer 1

have no chance of reaching the internal network

To the letter, that means a 100%, completely separate network. Cables, switches, router, everything. Short of a physical cabling mistake, there's no chance of the test environment touching the internal network.

However, I understand how that can be unattainable. So, you'd then fall back to using VLANs to create "virtual" isolation, and either a DMZ VLAN subinterface, or secondary real interface, at the firewall/router -- or a second firewall. The firewall/router would then require ACLs and/or other security rules to prevent the internal and DMZ networks from interacting -- beyond what very limited access you may want for management access.

I cannot overstate the need for as much physical isolation as possible. Even your VM host is a possible vector into your internal network -- don't count on the "VM" staying inside it's container.

(I've not touched a Watchguard in eons, so I cannot give you any details on how to configure yours.)