Hello!
I seem to be having a problem with hyper-v client. I'm running windows 10 x64, and installed hyper-v on my system. So far, it's a great hypervisor, and the features are just fantastic. I really wish MS would advertise this as a feature, because it's pretty
awesome.
Anyhoo, here's my problem:
I'm a malware analyst and I have the following network setup in hyper-v:
1 vswitch bridged to my workstation's physical network card. We'll call this vswitch1
3 private vswitches. We'll call these vswitch2, 3, and 4, respectively.
I have a PFsense VM connected to vswitch 1, 2, and 3. PFSense works fine and routes/firewalls properly between all the networks.
I have another VM, a debian 8 x64 linux VM. This VM is connected to vswitch 2 for management access, and connected to vswitch 3 and 4 to act as a bridge.
Why am I doing this? I plan on having malware analysis vms on vswitch 4. the debian VM acts as "fail-close"/failsafe in that if the malware does things I don't expect, I can power down the VM and remove its network access while leaving the PFSense
VM that is routing and firewalling for my other VM networks alone.
I've done this before and I have gotten this to work on virtualbox, vmware workstation, vmware fusion, and vmware ESX with zero problems.
I configure the interfaces that my IPS software will be sniffing on (in this case, assume I'm using the snort IPS):
- I turn off any and all checksumming and/or checksum offloading for the interfaces
- I put the interfaces into promiscuous mode
- I activate snort and configure it to bridge between my two network interfaces (eth1 and eth2, respectively) using AFPACKET.
I spin up a malware analysis VM and put it on vswitch 4 and... it can't reach anything at all. running TCPDUMP shows that broadcast traffic makes it to my IPS/failsafe VM, crosses the bridge, then my pfsense VM, connected to vswitch 3 never sees it. It doesn't
respond to ARP, it doesn't respond to DHCP.
So I gave my analysis vm a static IP address, a default route, its dns servers, and statically configured arp so that the VM would know the mac address of the PFSense VM (its default gateway) and... nothing worked still. It's almost as though vswitch 3 is
dropping the traffic somehow.
Now, when I do this in vmware ESX, I have to configure any vswitches that I'm bridging between to allow promiscuous mode for this to actually work. Knowing this, I did the following:
On my PFsense VM, I configured the interface on vswitch 3 to be a port mirroring SOURCE
On the IPS VM running debian, I configured the NIC connected to vswitch 3 to be a DESTINATION
On my malware analysis vm on vswitch 4, I configured it to be a port mirroring SOURCE
On the IPS VM running debian, I configured the NIC connected to vswitch 4 to be a DESTINATION
In order to ensure that my options were thoroughly exhausted, I've also tried over port mirroring permutations, all of which didn't work:
PFSENSE vswitch 3 as DESTINATION, IPS VM vswitch 3 as SOURCE
IPS VM vswitch 4 as SOURCE, analysis VM as DESTINATION
Analysis VM as SOURCE, IPS VM vswitch 4 as DESTINATION,
IPS VM vswitch 3 as SOURCE, PFSENSE vswitch 3 as DESTINATION
and still, it doesn't work, and I can't fathom why.
So let's recap:
- I'm trying to bridge to hyper-v vswitches together with a LINUX vm using AFPACKET bridging.
- I'm not asking for linux or IDS/IPS technical support. I've done this a number of time on other baremetal and hosted hypervisors and got it to work.
- Just so we're abundantly clear, I have checksum offloading turned off completely on the linux VM interfaces, and snort is operating with the "-k none" flag to NOT mess with network traffic checksums. Still no dice.
- I've turned on promiscuous mode on the linux vm's network interfaces, activate the bridge, and can see broadcast messages (DHCP requests and ARP requests) go across the AFPACKET bridge, but then something is preventing the VM on the other side from getting
the traffic. the fact that I can see the broadcast traffic on either side of the AFPACKET bridge leads me to believe that this isn't a linux problem, it's a problem with hyper-v, or the vswitch, or something.
- I am well aware of the vswitch port mirroring functions and they seem to not be working, at least in a way that I expect them to.
Please help if you can. Thanks!
I put in a consumer support ticket (1348219717) and was told to ask my question on the Microsoft Community forums who then told me that I should try asking the question here.
this is a verbatim copy of:https://answers.microsoft.com/en-us/windows/forum/windows_10-performance/hyper-v-vswitches-and-linux-afpacket-bridging/ad4b6716-3532-41ef-944b-8eafe54bef30?tm=1469201700464