Secure Sand box Network Set up Lab for malware analisys VLAN 99

18 May, 2025

Hola!

When I did the installation of the network I went full focused and I managed to do all in a roll (including the typical ups and downs in relation to being one self as the designer and the executor) ༼ಠ ل ಠ༽

I want to help myself of the future and dive deeper into creating a highly secure and isolated environment specifically for malware analysis using VLAN 999.... in a different post.

This setup ensures that malicious code can be safely analyzed without risking your host system, other virtual machines, or production networks.

in this series i am doing my own adaptation of this lab[https://facyber.me/posts/blue-team-lab-guide-part-5/]

Why Segment Networks for Malware Analysis?

Network segmentation is a cornerstone of secure lab environments, and it becomes even more critical when dealing with malware. By isolating specific network zones, you can achieve the following benefits tailored to malware analysis:

• Simulate Real-World Threats Safely: Replicate corporate network architectures to observe how malware behaves in a controlled setting.
• Enhance Security Through Isolation: Contain threats within a dedicated VLAN (999 in our topology) to prevent lateral movement or accidental infection of other systems.
• Enable Safe Malware Testing: Conduct dynamic and static analysis, penetration testing, and incident response drills without risking production environments.

Tools Used

This setup leverages the same robust toolkit introduced in our series, ensuring consistency and compatibility with your existing Proxmox environment:

• Proxmox VE: Our hypervisor for managing virtual machines (VMs) and containers.
• Linux Network Namespaces: Used to isolate network stacks within a single OS for simulating distinct network zones.
• VLANs: Logically separate traffic to emulate physical network segmentation.
• Bridges: Connect virtual interfaces for communication within namespaces or VMs.
• Iptables: Enforce strict traffic policies to maintain isolation between network zones.

Lab Topology

Our lab topology, as outlined in the series, includes multiple VLANs simulating different security zones. For this article, we focus on VLAN 999, dedicated exclusively to malware analysis, while maintaining the broader context of the environment:

Note: X represents variable octets for anonymization.

VLAN 999 is designed as a fully isolated segment with no connectivity to other VLANs or external networks, creating a secure "digital containment chamber" for analyzing malicious code.

Expected Traffic Flow

The traffic flow rules established in our series remain intact, with specific emphasis on VLAN 999’s isolation:

• VLAN 200 (External Simulation): Can initiate connections to VLAN 300 only.
• VLAN 300 (Internal Services): Responds only to VLAN 200 requests.
• VLAN 400 (Security Operations): Accesses VLAN 300 and external networks.
• VLAN 999 (Malware Analysis): Fully isolated, with no access to other networks or the internet.

This strict isolation ensures that malware samples executed within VLAN 999 cannot communicate with external command-and-control servers or spread to other parts of your lab or production environment.

Step-by-Step Setup for VLAN 999 Malware Analysis Lab

Building on the general segmentation setup from our series, the following steps focus on configuring VLAN 999 for secure malware analysis within your Proxmox environment.

1. Create a Dedicated Namespace for Malware Analysis

Start by creating a separate network namespace for the malware analysis environment to ensure complete isolation from other network stacks.

# Create an isolated namespace for malware analysis
ip netns add malware-lab

Tip: Using a dedicated namespace like malware-lab simulates a standalone network environment within your Proxmox host.

2. Set Up a Virtual Bridge for VLAN 999

Create a bridge within the namespace to connect virtual interfaces for VMs or containers used in malware analysis.

# Set up a virtual bridge for VLAN 999
ip link add malware-br type bridge
ip link set malware-br netns malware-lab
ip netns exec malware-lab ip link set malware-br up

Note: This bridge will serve as the internal network hub for VLAN 999, ensuring all traffic remains contained within the namespace.

3. Connect with veth Pairs

Use virtual Ethernet (veth) pairs to link the host to the namespace, acting as a virtual cable for internal connectivity.

# Create a veth pair to connect host to namespace
ip link add veth-mal0 type veth peer name veth-mal1
ip link set veth-mal1 netns malware-lab
ip link set veth-mal0 up
ip netns exec malware-lab ip link set veth-mal1 up
ip netns exec malware-lab ip link set veth-mal1 master malware-br

Tip: Ensure no external interfaces are connected to this bridge to maintain isolation.

4. Configure VLAN 999

Define VLAN 999 on the bridge to logically separate its traffic from other network segments.

# Create VLAN 999 interface within the namespace
ip netns exec malware-lab ip link add link malware-br name vlan999 type vlan id 999
ip netns exec malware-lab ip link set vlan999 up

Recommendation: Script this step if you plan to rebuild the environment frequently for clean analysis sessions.

5. Assign IP Addressing for VLAN 999

Assign a static IP range to VLAN 999 based on our topology. This small subnet (/30) limits the number of devices, further reducing risk.

# Assign IP for VLAN 999
ip netns exec malware-lab ip addr add 192.168.254.1/30 dev vlan999

Note: Avoid using DHCP within VLAN 999 to prevent any potential leakage or misconfiguration.

6. Set Up Strict Firewall Rules for Isolation

Implement iptables rules to enforce a default-deny policy, ensuring no traffic can enter or leave VLAN 999.

# Set default policies to DROP
ip netns exec malware-lab iptables -P INPUT DROP
ip netns exec malware-lab iptables -P FORWARD DROP
ip netns exec malware-lab iptables -P OUTPUT DROP

# Allow only local traffic within the namespace
ip netns exec malware-lab iptables -A INPUT -i lo -j ACCEPT
ip netns exec malware-lab iptables -A OUTPUT -o lo -j ACCEPT

Recommendation: Regularly audit these rules to ensure no accidental allowances are introduced during testing.

7. Deploy Analysis VMs in VLAN 999

Create and configure virtual machines for malware analysis within Proxmox, ensuring their network interfaces are connected exclusively to VLAN 999.

• Windows Analysis VM: Install tools like Flare VM for comprehensive malware analysis.
• Linux Analysis VM: Use REMnux, a purpose-built distribution for reverse engineering and malware analysis.
• Network Monitoring VM: Deploy a VM with Wireshark or tcpdump to capture traffic within VLAN 999.

Tip: Take snapshots of these VMs before each analysis session to revert to a clean state after testing.

Validation of Isolation

Verify the isolation of VLAN 999 to ensure no traffic can escape or enter this segment. Use the following commands within the malware-lab namespace:

# Check IP configuration
ip netns exec malware-lab ip addr show

# Verify no external routes exist
ip netns exec malware-lab ip route show

# Confirm firewall rules are in place
ip netns exec malware-lab iptables -L -v -n

Additionally, test connectivity using ping or traceroute from within VLAN 999 to external addresses (e.g., 8.8.8.8) and other VLANs (e.g., VLAN 200) to confirm isolation. Use Wireshark or tcpdump within VLAN 999 to monitor for any unexpected traffic.

Tip: If any connectivity is detected, revisit your iptables rules and bridge configuration to identify and close gaps.

Best Practices for Malware Analysis in VLAN 999

• Snapshot VMs Regularly: Always create a snapshot of your analysis VMs before executing malware to ensure you can revert to a clean state.
• Monitor Internally: Use tools like Wireshark within VLAN 999 to capture and analyze malware-generated traffic without risking external exposure.
• Log Everything: Maintain detailed logs of malware hashes, behaviors, and network activity for future reference and analysis.
• Secure Sample Transfer: Use a one-way transfer mechanism (e.g., a temporary VM or secure file copy within the namespace) to move malware samples into VLAN 999 without connecting it to external networks.
• Rebuild Frequently: Periodically rebuild the environment to eliminate any residual effects of malware testing.

Stay tuned for my article Advanced Network Segmentation in Proxmox series, where we’ll explore additional use cases and advanced configurations for your segmented lab environment. If you’re in Lucerne, Switzerland, or nearby, consider joining local tech meetups to discuss Proxmox setups and network security with fellow enthusiasts!

Discuss this post: Bluesky It was challenging keep track of the "right recipe" let me know if you find a issue we could work it together!