Cybersecurity Lab Part 2: Single-Node Proxmox

auto lo
iface lo inet loopback
 
auto enp4s0
iface enp4s0 inet manual
 ovs_type OVSPort
 ovs_bridge vmbr0
 
auto enx00e04c680140
iface enx00e04c680140 inet manual
 ovs_type OVSPort
 ovs_bridge vmbr1
 
auto vlan10
iface vlan10 inet manual
 ovs_type OVSIntPort
 ovs_bridge vmbr2
 ovs_options tag=10
#vlan10
 
auto vlan20
iface vlan20 inet manual
 ovs_type OVSIntPort
 ovs_bridge vmbr2
 ovs_options tag=20
#vlan20
 
auto vmbr0
iface vmbr0 inet static
 address 192.168.0.250/22
 gateway 192.168.1.1
 ovs_type OVSBridge
 ovs_ports enp4s0
 
auto vmbr1
iface vmbr1 inet manual
 ovs_type OVSBridge
 ovs_ports enx00e04c680140
#WAN
 
auto vmbr2
iface vmbr2 inet manual
 ovs_type OVSBridge
 ovs_ports vlan10 vlan20
#LAN
 
source /etc/network/interfaces.d/*

sudo chmod +x /var/lib/vz/snippets/port-mirror.sh
qm set <VM_ID> --hookscript local:snippets/port-mirror.sh

#!/usr/bin/env bash
set -euo pipefail
 
VM_ID="${1:-""}"
EXECUTION_PHASE="${2:-""}"
 
VM_BRIDGE="vmbr2"
LOGGING="/root/scripts/port-mirror.log"
MIRROR_NIC_INDEXES=("1")
 
log() { /usr/bin/date >> "$LOGGING"; /usr/bin/echo "$*" >> "
port_exists() { /usr/bin/ovs-vsctl --if-exists get Port "$1" _uuid >/dev/null 2>&1;
bridge_exists() { /usr/bin/ovs-vsctl --if-exists get Bridge "$VM_BRIDGE" _uuid >/dev/null 2>&1; }
 
create_mirror_for_idx() {
 local idx="$1"; local tap="tap
 bridge_exists || { log "ERROR: bridge '$VM_BRIDGE' missing"; return 0; }
 port_exists "$tap" || { log "WARN: port '$tap' missing"; return 0
 log "Creating mirror '$mirror' on '$VM_BRIDGE' output '$tap'"
 /usr/bin/ovs-vsctl --if-exists destroy Mirror "$mirror" >> "$LOGGING" 2>&1 || true
 /usr/bin/ovs-vsctl \
 -- --id=@tap get Port "$tap" \
 -- --id=@m create Mirror name="$mirror" select-all=true output-port="@tap" \
 -- add Bridge "$VM_BRIDGE" mirrors "@m" >> "$LOGGING" 2>&1
 log "OK: mirror '$mirror' created"
}
 
clear_mirror_for_idx() {
 local idx="$1"; local mirror="${
 bridge_exists || { log "WARN: bridge '$VM_BRIDGE' missing"; return 0; }
 log "Clearing mirror '$mirror' from '$VM_BRIDGE'"
 /usr/bin/ovs-vsctl -- --id=@m get Mirror "$mirror" -- remove Bridge "$VM_BRIDGE" mirrors "
 /usr/bin/ovs-vsctl --if-exists destroy Mirror "$mirror" >> "$LOGGING" 2>&1 || true
 log "OK: mirror '$mirror' cleared"
}
 
show_mirrors() { log "Show existing mirrors:"; /usr/bin/ovs-vsctl list Mirror >> "$LOGGING" 2>&1
 
[[ -z "$VM_ID" || -z "$EXECUTION_PHASE" ]] && { log "Missing args
 
case "$EXECUTION_PHASE" in
 post-start)
 sleep 30
 for idx in "${MIRROR_NIC_INDEXES[@]}"; do create_mirror_for_idx "$idx
 show_mirrors
 ;;
 pre-stop)
 for idx in "${MIRROR_NIC_INDEXES[@]}"; do clear_mirror_for_idx "$idx
 show_mirrors
 ;;
 *)
 log "Ignoring phase: ${EXECUTION_PHASE} for VM ${VM_ID}"; exit 0;
 ;;
esac

hookscript: local:snippets/port-mirror.sh
net0: virtio=BC:24:11:AB:B1:B1,bridge=vmbr2,tag=20
net1: virtio=BC:24:11:DE:99:B2,bridge=vmbr2
# net1 has no tag so it receives all mirrored VLANs

ip link set eth1 up
ip link set eth1 promisc on # optional; Suricata/Zeek usually do this

VLAN10 Users: 10.10.0.0/16, DHCP 10.10.0.50-10.10.0.200
VLAN20 Infra: 10.20.0.0/16, DHCP 10.20.0.50-10.20.0.120
Admin GUI: http://192.168.3.237/

# VLAN10 test (expect internet, restricted infra)
ping -c3 1.1.1.1
curl -I https://homelabird.com
# optional: should fail or be limited if blocking VLAN20
ssh admin@10.20.0.10
 
# VLAN20 test (mgmt + sensor reachability)
# pfSense admin UI is http://192.168.3.237/
ssh soadmin@securityonion # mgmt IP on VLAN20

sudo so-status
sudo tcpdump -i eth1 -c 5