Prove the isolation before you trust it

short · 35 min

Task

Prove, with commands rather than with the hypervisor's claim, that your lab VMs can reach each other and cannot reach anything else. Then snapshot both, so every later lab has a known-good state to return to.

Steps

  1. From the Linux VM, confirm the peer is reachable: ping -c 2 10.99.0.20.
  2. Confirm there is no default route, which is the real test: ip route must show no default via line.
  3. Confirm the internet is unreachable rather than merely slow: curl -s -m 5 -o /dev/null -w '%{http_code}\n' https://example.com || echo 'no route — correct', and getent hosts example.com || echo 'no resolution — correct'.
  4. From the Windows VM, run Test-NetConnection 10.99.0.10 and expect success, then Test-NetConnection example.com -Port 443 and expect failure.
  5. Write the results to /tmp/isolation.txt with a timestamp, so that when a later lab misbehaves you can tell whether the isolation changed.
  6. Snapshot both VMs and name the snapshot clean.

Verify

ip route | grep -c '^default' ; echo "(must be 0)"
ping -c 2 -W 2 10.99.0.20 >/dev/null 2>&1 && echo "peer reachable: correct"
curl -s -m 5 https://example.com >/dev/null 2>&1 && echo "INTERNET REACHABLE - NOT ISOLATED" || echo "no internet: correct"
grep -c . /tmp/isolation.txt

The first must print 0. A default route means the guest can leave your lab whatever the hypervisor's network mode claims, and that single line is the most reliable test there is. The second must confirm the peer answers, otherwise the lab is isolated from itself. The third must print the no internet branch. The fourth must be non-zero — you have a dated record.

Notes

Do this again after any change to the hypervisor's networking, and after any lab that touches the firewall. An air gap is a control that needs continuous verification, not a one-time design decision — the same point the Domain 3 lesson makes about the ones that quietly break.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.