Protecting VBox Virtual Networks

Be careful in a host having "ip_forwarding" (routing) kernel option enabled. Consider aways set iptables "filter" (firewall) rules. Setting up just iptables "masquarade" (nat) may allow access from outside.

$ sudo su -

# vi /etc/iptables_FW_rules
*filter
#
# Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
#
# Accepts all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Accepts all established routed connections
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# VIRTUALBOX VIRTUAL NETWORKS PROTECTION
# vboxnetX is created by type "host-only network" on VBox Manager
-A FORWARD -i eth+ -o vboxnet+ -j REJECT
-A FORWARD -i wlan+ -o vboxnet+ -j REJECT
# allow VMs access outside
-A FORWARD -i vboxnet+ -o eth+ -j ACCEPT
-A FORWARD -i vboxnet+ -o wlan+ -j ACCEPT
#
# Allows all outbound traffic
# You may want to modify this to only allow certain traffic
-A OUTPUT -j ACCEPT
#
# Allow ping request to host
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
#
# log host denied calls (access via 'dmesg' command)
#-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
#
# Reject all other inbound - default deny unless explicitly allowed policy:
-A INPUT -j REJECT
-A FORWARD -j REJECT
COMMIT


# vi /etc/init.d/iptables-on-boot.sh
#!/bin/sh
/sbin/iptables-restore < /etc/iptables_FW_rules


# chmod ug+x /etc/init.d/iptables-on-boot.sh


# runlevel


# ln -s /etc/init.d/iptables-on-boot.sh /etc/rc2.d/S30iptables-on-boot



---- useful commands ---

Flush (clear) rules to test:
# iptables -F (flush default type filter/FW rules)
# iptables -t nat -F (flush masquerade/NAT rules)

For a complete report on iptables rules:

# iptables -L -v -n
# iptables -t nat -L -v -n

VBox Virtual Networks Quick Guide

While I'm writing this post, VirtualBox 4.3.4 "NAT networks" (Network Address Translation Service) don't work properly (still experimental), so to have an internal network where VMs are accessible by Host but NOT from outside, and VMs are able to access networks outside host (as internet), I had to:

1) on Host VirtualBox Manager > file > preferences >  network > host-only networks > add; on the (guest) VM settings > network > attached to > host-only adapter > set proper name

2) on Host, enable routing on the kernel:
$ sudo vi /etc/sysctl.conf
uncomment "net.ipv4.ip_forward=1"

3) on Host, enable NAT outside:
$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$ sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

To make it persistent under a Debian/Linux Mint host, create a new ifup rule:

$ sudo vi /etc/network/if-up.d/iptables_NAT_vboxnet_out

#!/bin/sh
#
# Don't bother to do anything for lo or VBoxNets.
IFTYPE=$(echo "$IFACE" | cut -c1-2)
if [ "$IFTYPE" = lo -o "$IFTYPE" = vb ]; then
    exit 0
fi
# Only run from ifup.
if [ "$MODE" != start ]; then
    exit 0
    else
    iptables -t nat -A POSTROUTING -o "$IFACE" -j MASQUERADE
fi

$ sudo chmod ugo+x /etc/network/if-up.d/iptables_NAT_vboxnet_out

Reestart the Host to test.