Partitioning servers from the rest of the network

Question

I'm an undergraduate looking for ways to experiment with network security techniques on my residential local area network, so much of this is going to be very new to me. Forgive me in advance for asking a question that might be obvious to others. My intention is to run two devices -- a RPi running Kali Linux and another device running Metasploitable.

I have a separate box running Kali because I want to be able to run tools from a network I control rather than running them from the university's network, which understandably frowns on the use of penetration testing tools. I ssh into this box from the university and use it to interact with wargaming servers.

I would like to set up my own Metasploitable server to attack because I have peers that I work with (we're all learning these things together) and I would like us all to practice running these tools together (and give them a legitimate target to operate against) and it gives me a chance to learn network hardening techniques against live opponents.

My issue, naturally, is with putting an intentionally unsecure box on the network. The logs in the Kali RPi are filled with brute force attacks, and putting a metasploitable box on the network seems like an invitation to disaster if I can't partition the server away from things like my NAS (which is mostly filled with a terabyte of family photos).

This device: http://www.amazon.com/Cisco-Systems-Wireless-Security-RV215WAK9NA/dp/B00AHSNQNS appears ready to set up a VLAN. I don't know a whole lot about VLAN (as I've said, I'm a student), but it seems to me that a VLAN is just the sort of thing I need. Is my instinct here correct, or would there be an unacceptable level of danger (should the intentionally-vulnerable server get compromised by someone other than my colleagues) of exposure to other adjacent virtual networks?

Answer 1

Remember, that while you may intend for it to be used by you and your friends, it will be on the Internet and open for anyone to exploit.

Personally, if exposing an intentionally vulnerable device on the Internet is the goal, then the more separation the better. I would recommend getting an entirely separate Internet connection (with it's own hardware) to dedicate to the vulnerable host. Treat anything that is connected to that network as compromised after the exploitable device is exposed, including any network devices.

To make it easier on yourself, make everything as easy to restore as possible. Before exposing anything get everything configured and secure. Archive backups of configurations and systems (do not store on the same network where it will be exposed). Use software that Deep Freezes systems or makes them easy to restore. That way, when it comes time to make sure everything is secure again, it takes as little work as possible (possibly just reboots or factory defaulting with configuration restores).

Use unique passwords for each device in that environment that you haven't ever used elsewhere. Change these passwords every time you expose the vulnerable network.

Possibly most important, only expose the vulnerable system when you are actually using it. Primarily because exploited systems can be used in attacks on other entities. Preventing having your systems participate in attacks elsewhere is first an foremost being a good "netizen" but if that isn't enough imagine that your exploitable system came back to bite you personally (i.e. used in an attack that exposed your financials, etc). Also depending on laws where you live, you may be liable for damages done from an intentionally exploitable system. Finally, this will also help prevent it becoming a widely known soft target.

What I mean by my last statement is that "soft targets" get put on lists and sometimes shared by those online looking to exploit systems. You mention that "logs in the Kali RPi are filled with brute force attacks." If your RPi isn't taking action on these brute force attacks (i.e. dropping traffic from source IPs after X failed attampts, etc) the number of these attacks will only increase over time. If the RPi takes action, it will see fewer attempts over time (they will never completely go away).

Answer 2

VLANs give you layer-2 (broadcast) separation, but not layer-3 (IP) separation, and it sounds like you need layer-3 separation. To prevent access from one VLAN to another where both terminate on the same router, you will need to put in an ACL to prevent access between the VLANs.

An intentionally insecure box is still just as insecure on any VLAN where you place it, and if the router is the same router for the VLANs, you aren't really adding any security between VLANs unless you put an ACL on the router to prevent access from one VLAN to the other, and this will disallow traffic between VLANs, so you would need to be outside your network to access the insecure VLAN, and your tools server would also need to be outside your network if it needs to access the insecure VLAN.

If your boxes are both on your network behind a firewall, you could set up a VPN to cross your firewall, and you can restrict access to the VPN to a specific group of people. That way, you have a vulnerable box that is not publicly exposed, but you and your friends can attack it as you please through the VPN.

I'm not sure VLANs actually gain anything for you, but a security router with built-in firewall and VPN could be what you are looking for.