Smaller Malware Analysis Network Layout
If your just going to run malware for a small amount of time. Then just having 3 VLAN’s would be fine. One Vlan is your local LAN, second Vlan is malware LAN on Proxmox, and third Vlan is mangement LAN of Proxmox. Add firewall rules either on Proxmox or another device like dietpi physical router or Pfsense VM to block LAN to LAN communication, and just NAT traffic. You could also use two VLAN’s one for malware side, and the other for your local LAN.
Get Ruben’s stories in your inbox
Join Medium for free to get updates from this writer.
Another thing to keep in mind is that in Proxmox separate bridges can’t talk to each other by default at layer 2. The same is true for Vmware vSphere; two switches are isolated by default at layer 2. If your not going to be running malware for that long. It probably is okay to just use separate switches in your hypervisor. Adding a VLAN to just malware LAN will help isolate it further. Below is what our layout will look like.
ProxMox Setup
We can start by creating a bridge in our Hypervisor. I’m using Proxmox so I went to Network -> create -> new linux bridge -> click create. Make sure VLAN aware is checked. This new option will make the Linux bridge act like a layer 3 switch and trunk port. Leaving it unchecked makes the linux bridge act like a dumb switch. VM’s can still talk to each other but Vlan isolation isn’t solid, data can leak. Plus you need a physical port connected to bridge if it isn’t set to Vlan aware. I will make another article going over what happens with this checked and unchecked.
Next I will create 3 VM’s. Proxmox VM is created with 2 NIC’s one is my bridge going to local Lan through Vlan 6. The second one is the Vlan 7 bridge we had made. I set boot to SeaBIOS since Uefi didn’t work even with secure boot disabled. You don’t need to set VLAN tags inside Linux server or pfsense since our VM’s are Vlan tagged in settings. The Wan interface on Pfsense will be the connection to Vlan 6. While the Lan interface will be our Linux bridge we made that uses Vlan 7.
Pfense doesn’t work as well with OpenVPN profiles. It does have an option to setup a VPN which might work well with other VPNs. For this demonstration we will use a Linux VM that will be our OpenVPN client. I setup a Ubuntu 24 server with a Nic connected to Vlan 6 which goes out to local network.
I set the Ubuntu server to use 192.168.1.3 IP address
Pfsense by default does a good job blocking traffic on WAN side. Also once you add the block rules I show. It will block traffic to any private subnet. For this setup I will leave reserved networks checked. But if you want to allow access to web gui over WAN interface on Pfsense you will need to uncheck these and add a firewall rule to allow web gui access on WAN. It’s preferable not to have web gui access on side facing malware Lan to limit attack surface on firewall.
The great thing about Pfsense is the Web Gui allows fast configuration setup such as the DHCP server below setup on the LAN interface
Now in our test Windows VM we have set the Nic to connect to Vlan 7 bridge and we can see that a ping to google works. Next we can try to ping the Linux router at 192.168.1.3 which works by default.
What we need to do now is block LAN connections from the Malware Lan. We only want them to go out to Internet. Go into Pfsense -> Firewall -> Aliases -> choose Networks for type. Create the Alias below with the 3 private class subnets and click save.
Now go into Firewall -> rules -> LAN -> click on add with up arrow. Select block for action. And set the Alias you made earlier as destination. Finally click save and apply
As we can see a ping to internet works, while a ping to the Linux server at 192.168.1.3 doesn’t work. The server has port 22 open. So I did a nmap scan which shows no ports open. Keep in mind Nmap will say online because we used option -Pn to skip the ping discovery scan.
This is the end of setup for Pfsense setup. Since my demonstration will focus more on OpenVPN server. I am leaving these default rules on in LAN side. Keep in mind if you disable the anti-lockout rule below on Lan you will lose Web gui access. To allow Web gui on Wan you will need to enable Wan access in Wan firewall rules area, and configure a couple other areas. The rules below the PrivateSubnets Lan subnets should be left on. Or else you won’t be able to ping out to the internet.
OpenVPN Setup
In Aws I chose a Ubuntu EC2 server instance. In order to allow OpenVPN to work you will need to allow inbound in security group port 1194 and 443 for the VM on public side.
After that sign into your server instance. Download the openvpn script from https://github.com/angristan/openvpn-install?tab=readme-ov-file and run the installer
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
sudo ./openvpn-install.shWhen you run the shell script it will ask for the IP address put in your public IP address of your EC2 instance. Choose all defaults and eventually press enter to start install.
After install happens you will be able to generate the client. For mine i chose testuser. Choose defaults for the rest and install should finish telling you where files are saved. You should now have a testuser.ovpn file which you will need to copy to the Linux server in Proxmox.
Now on our Linux server in Proxmox we need to enable network routing by editing /etc/sysctl.conf and uncommenting the line net.ipv4.ip_forward = 1 Finally run sudo sysctl -p to apply it
Run the commands below to install Openvpn and install the profile you copied
sudo apt update
sudo apt install openvpn
# create directory to store you ovpn file *Note might already be created
sudo mkdir -p /etc/openvpn/client
sudo cp your-profile.ovpn /etc/openvpn/client/client.conf
# commented out is what to do if you set a username password pair
# add your username and password to the file below
# sudo nano /etc/openvpn/client/credentials
# update client.conf to include credentials
# auth-user-pass /etc/openvpn/client/credentials
# secure the file
# sudo chmod 600 /etc/openvpn/client/credentials
Start openvpn service and enable it. Finally verify that you are getting a public ip from VPN provider. As we can see below I am getting the public IP of my Ec2 instance.
Final step on Linux router is to setup iptables to do NAT routing out through NAT tunnel. run sudo apt install iptables-persistent to be able to save iptables rules on reboot.
sudo iptables -t nat -A POSTROUTING -o tun0 -s 192.168.1.0/24 -j MASQUERADE
sudo iptables -A FORWARD -i ens18 -o tun0 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -o ens18 -d 192.168.1.0/24 -j ACCEPT
sudo netfilter-persistent saveGo to the Pfsense firewall and change it’s default gateway to point to Linux router 192.168.1.3. You will need to go to system->routing->gateways. In there edit Wan gateway to be 192.168.1.3 -> click save and then apply
Finally test it on your Windows VM. Below we can see dnsleak is showing my EC2 as public ip and DNS servers as google ones.
Another test is a tracert from the Windows VM. As shown below the first one was before OpenVPN setup. I did blur closer hops out from my ISP for privacy reasons. The second tracert is showing the path going out through our OpenVPN setup.
Closing thoughts
There are rules you can apply to the Pfsense to block icmp to the firewall itself. The same can be done to the Linux router through iptables. This will make it so a tracert will show request timed out. This can help you hide your network topology further from Malware. Keep in mind if your Linux router reboots there might be a race condition before the OpenVPN is connected. This may leak data as the Linux router might be routing through your ISP before OpenVPN kicks in. To fix this you can setup boot scripts to delay routing until OpenVPN connects. The final consideration is DNS leaking. At no point should any of your routers or firewalls that Malware LAN uses be having DNS set to your ISP as this will leak data out. Pfsense and Linux router DNS set to another DNS like 8.8.8.8 helps. Plus the OpenVPN connection hides your ISP to the Malware LAN. They will only be able to trace out through your tunnel.
