Skip to content

21/09/26 VLAN Isolation for Pentesting VM

  • Created a dedicated VLAN for the Parrot OS pentesting VM.
  • Kept the Proxmox management interface on the trusted LAN.
  • Tagged the Parrot VM onto the isolated VLAN through the managed switch and Proxmox bridge.
  • Enabled network isolation on the pentesting VLAN.

  • Added firewall rules blocking Parrot from:

  • Trusted homelab systems.

  • Household network devices.
  • Router management interfaces.
  • Kept outbound Internet access working for updates, HTB, VPNs, and research.
  • Allowed one trusted workstation to manage Parrot.
  • Enabled Parrot's host firewall with default-deny inbound.
  • Restricted SSH to the trusted workstation only.
  • Disabled SSH password authentication and root login.
  • Enabled Proxmox firewalling for the VM.
  • Added MAC/IP anti-spoofing protections at the hypervisor.
  • Added an IPv6 egress block at the hypervisor.
  • Confirmed the VM has no routed IPv6 path.
  • Verified isolation with ping and TCP tests instead of trusting configuration alone.

  • Confirmed:

  • Parrot → Internet works.

  • Parrot → trusted LAN fails.
  • Parrot → household LAN fails.
  • Parrot → router management fails.
  • Trusted workstation → Parrot works.
  • Avoided publishing internal addressing, VLAN IDs, hostnames, ports, and firewall object names publicly.

TO DO: - Set up Cloudflare VNC for remote access. - Set up MFA