Build the lab and prove it cannot reach anything

short · 60 min

Task

Build the three-part lab this course assumes -- a log source, a collector, a search interface -- and then prove the isolation rather than trusting the hypervisor's label for it.

Steps

  1. Create a host-only or internal network with its own subnet, 10.10.10.0/24, which you use nowhere in real life. Give the Linux VM 10.10.10.10 and the Windows VM 10.10.10.20.
  2. Remove every other adapter from both VMs. If you attached a NAT adapter to install packages, detach it now -- this is the step people skip.
  3. On the Linux VM, install rsyslog and configure it to receive over TCP on port 514, writing into /var/log/collected/. This is your collector.
  4. On the Windows VM, enable process creation logging with the command line (Event ID 4688 plus the "Include command line" policy) and install Sysmon with a public configuration. Forward events to the collector.
  5. Snapshot both VMs and label the snapshot clean.
  6. Now test the isolation from inside each VM, using the Verify block below.

Verify

ping -c 2 10.10.10.20; echo "lab reachable: $?"
ip route get 192.0.2.1 2>&1 | grep -c unreachable
curl -s -m 5 -o /dev/null -w "%{http_code}" http://example.com; echo
ip route | grep -c default
ls /var/log/collected/ | wc -l

The first must succeed. The second must print 1: with no default route, a lookup for an address outside the lab subnet is unreachable, and on a VM that still has a route out it is not -- which is a sharper test than a ping, and it names nobody's infrastructure. The third must be empty or 000 and the fourth zero. A lab that can reach the internet is not a lab, and the ping to the other VM is what proves you tested isolation rather than simply breaking networking.

The last line must be non-zero once the Windows VM has sent anything, which is what proves the collector is actually collecting.

Notes

Do this properly once. Every later lab assumes it, and the failure mode of a half-isolated lab is not that a lab fails -- it is that something you ran deliberately reaches a network you did not intend.

Re-run the Verify block after any change to the VMs. Isolation is a property that decays quietly, usually the day you attach an adapter to install one package.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.