Protecting VBox Virtual Networks

Be careful in a host having "ip_forwarding" (routing) kernel option enabled. Consider aways set iptables "filter" (firewall) rules. Setting up just iptables "masquarade" (nat) may allow access from outside.

$ sudo su -

# vi /etc/iptables_FW_rules
*filter
#
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
#
# Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Accepts all established routed connections
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# VIRTUALBOX VIRTUAL NETWORKS PROTECTION
# vboxnetX is created by type "host-only network" on VBox Manager
-A FORWARD -i eth+ -o vboxnet+ -j REJECT
-A FORWARD -i wlan+ -o vboxnet+ -j REJECT
# allow VMs access outside
-A FORWARD -i vboxnet+ -o eth+ -j ACCEPT
-A FORWARD -i vboxnet+ -o wlan+ -j ACCEPT
#
# Allows all outbound traffic
# You may want to modify this to only allow certain traffic
-A OUTPUT -j ACCEPT
#
# Allow ping request to host
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
#
# log host denied calls (access via 'dmesg' command)
#-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
#
# Reject all other inbound - default deny unless explicitly allowed policy:
-A INPUT -j REJECT
-A FORWARD -j REJECT
COMMIT


# vi /etc/init.d/iptables-on-boot.sh
#!/bin/sh
/sbin/iptables-restore < /etc/iptables_FW_rules


# chmod ug+x /etc/init.d/iptables-on-boot.sh


# runlevel


# ln -s /etc/init.d/iptables-on-boot.sh /etc/rc2.d/S30iptables-on-boot



---- useful commands ---

Flush (clear) rules to test:
# iptables -F (flush default type filter/FW rules)
# iptables -t nat -F (flush masquerade/NAT rules)

For a complete report on iptables rules:

# iptables -L -v -n
# iptables -t nat -L -v -n

VBox Virtual Networks Quick Guide

While I'm writing this post, VirtualBox 4.3.4 "NAT networks" (Network Address Translation Service) don't work properly (still experimental), so to have an internal network where VMs are accessible by Host but NOT from outside, and VMs are able to access networks outside host (as internet), I had to:

1) on Host VirtualBox Manager > file > preferences >  network > host-only networks > add; on the (guest) VM settings > network > attached to > host-only adapter > set proper name

2) on Host, enable routing on the kernel:
$ sudo vi /etc/sysctl.conf
uncomment "net.ipv4.ip_forward=1"

3) on Host, enable NAT outside:
$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$ sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

To make it persistent under a Debian/Linux Mint host, create a new ifup rule:

$ sudo vi /etc/network/if-up.d/iptables_NAT_vboxnet_out

#!/bin/sh
#
# Don't bother to do anything for lo or VBoxNets.
IFTYPE=$(echo "$IFACE" | cut -c1-2)
if [ "$IFTYPE" = lo -o "$IFTYPE" = vb ]; then
    exit 0
fi
# Only run from ifup.
if [ "$MODE" != start ]; then
    exit 0
    else
    iptables -t nat -A POSTROUTING -o "$IFACE" -j MASQUERADE
fi

$ sudo chmod ugo+x /etc/network/if-up.d/iptables_NAT_vboxnet_out

Reestart the Host to test.

Keeping Firefox + Java up-to-date on a Linux Mint

1) UPDATE FIREFOX

Copy the link of updated Firefox from ftp://ftp.mozilla.org/pub/firefox/releases/ (navigate through the right version / platform /  language)

$ cd /opt
$ sudo wget FIREFOX_DOWNLOAD_LINK
$ sudo tar xjf firefox-VERSION.tar.bz2
$ sudo mv firefox firefox-VERSION
$ sudo rm firefox-VERSION.tar.bz2
$ sudo ln -sf /opt/firefox-VERSION/firefox /usr/bin/firefox

(ref: # ln -sf TARGET LINK)


2) UPDATE JAVA

Copy the link of updated Java from http://www.java.com/en/download/manual.jsp list (Debian like users should choose "Linux" or "Linux x64")

$ sudo wget JAVA_DOWNLOAD_LINK
$ sudo mv DOWNLOAD_FILENAME java.tar.gz
$ sudo tar xzf java.tar.gz
$ sudo rm java.tar.gz

You should have a new /opt/jreVERSION

Now update the Java sym links:

$ sudo ln -sf /opt/jreVERSION/bin/java /etc/alternatives/java
$ sudo ln -sf /opt/jreVERSION/bin/java_vm /etc/alternatives/java_vm
$ sudo ln -sf /opt/jreVERSION/bin/javaws /etc/alternatives/javaws


3) UPDATE USER FIREFOX JAVA PLUGIN LINK

And last update the user Firefox Java plugin sym link:

$ ln -sf /opt/jreVERSION/lib/amd64/libnpjp2.so ~/.mozilla/plugins/libnpjp2.so
(if the platform is 64bits)

Restart Firefox and... voilá!



Refs:
http://www.libre-software.net/how-to-install-firefox-on-ubuntu-linux-mint