-2

I'm creating a lab for a project that will test a network security defense product's effectiveness in detecting various attacks. I have a physical server with 32GB of RAM and VirtualBox to create the network. I have one Windows server as a domain controller, DNS server, and maybe DHCP server, five Windows 7 machines to represent typical workstations, a Ubuntu server to run an internal website, probably email, and a probably a few other services, a network security defense project to analyze network traffic (I have Security Onion running Snort and will likely include other vendor products), and a Kali Linux box to represent an attacker trying to get into the network.

I don't want the Kali box already in the internal network as I don't think that would be very realistic- I want the attacker coming in from the outside. The network defense product needs to see network traffic inside the LAN so it can try to pick up the exploitation and post exploitation network activity, and it also needs to see C2 traffic going to and from the Kali box.

I will be testing attack vectors like email phishing with file format exploits, links to client side attacks, weak credentials in network services, exploitable and misconfigured network services, etc. and various post exploitation activities like escalating privileges, moving laterally across the network, and exfiltrating data.

I'm wondering how I can configure the network so that the Kali box is on the outside trying to break into the LAN of the lab network. I have created a network diagram, but I want to know if it will work, if there will be certain issues, or there is a better way to implement this. Please try to note that this will be implemented on a remote server. Here is the diagram I have created: http://gyazo.com/4d714084b9fe04f82cfd78a89a3d664a

Please let me know if you have any questions. Any help would be greatly appreciated. Thank you.

DrDinosaur
  • 323
  • 2
  • 3
  • 11
  • 1
    What's the VirtualBox for? It is not designed for this, and I'm fairly sure it can't handle it. – Michael Hampton Jan 04 '15 at 13:55
  • VirtualBox is running the VMs. I've read it can build basic lab networks, so I would imagine there would be a way to just place the Kali box outside somehow. – DrDinosaur Jan 04 '15 at 22:09

1 Answers1

0

This has been solved using two internal networks with VirtualBox. The network security device (Security Onion) has two interfaces, one interface for each network. It has IP forwarding enabled so it can route. The Kali machine sets its default gateway to the Security Onion box's IP address for its interface that has the network it shares with Kali (192.168.1.1/24). The Windows and Ubuntu devices set their gateway to the other IP address Security Onion has (10.0.0.1/24). Now you have two networks that can communicate. You can add a NAT interface on each VM if you want access to the Internet. Image: http://gyazo.com/9e61ad8e205ca19b890acade8e460a23

DrDinosaur
  • 323
  • 2
  • 3
  • 11